CVE-2025-55166
svg-sanitizer By-Passing Attribute Sanitization
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
svg-sanitizer By-Passing Attribute Sanitization
savg-sanitizer is a PHP SVG/XML sanitizer. Prior to version 0.22.0, the sanitization logic in the cleanXlinkHrefs method only searches for lower-case attribute name, which allows to by-pass the isHrefSafeValue check. As a result this allows cross-site scripting or linking to external domains. This issue has been patched in version 0.22.0.
Reserved 2025-08-07 | Published 2025-08-12 | Updated 2025-08-12 | Assigner GitHub_MCWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
github.com/...itizer/security/advisories/GHSA-22wq-q86m-83fh
github.com/...ommit/5a0a1eaf0c6b0b540dc945fe30c93cf106b357c1
Support options
