IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-08-12 17:15

MODIFIED

2025-08-13 17:34

EPSS (Prob. Exploit)

0.54%

Top 54.1%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08

> DESCRIPTION

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to version 0.22.0, the sanitization logic in the cleanXlinkHrefs method only searches for lower-case attribute name, which allows to by-pass the isHrefSafeValue check. As a result this allows cross-site scripting or linking to external domains. This issue has been patched in version 0.22.0.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-22wq-q86m-83fh MODERATE

svg-sanitizer Bypasses Attribute Sanitization

AFFECTED PACKAGES:

COMPOSER / enshrined/svg-sanitize

< 0.22.0

Fixed in: 0.22.0

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

svg-sanitizer By-Passing Attribute Sanitization

AFFECTED PACKAGES:

Unknown / Unknown

43 versions affected

ALIASES:

GHSA-22wq-q86m-83fh

> HISTORIQUE DES MODIFICATIONS

Première apparition

12/08/2025 17:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:07

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui