enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

Medium · CVSS 5.4

## Summary A crafted SVG bypasses `enshrined/svg-sanitize`'s href validation and delivers a `javascript:` URL through the sanitizer unchanged. The bypass exploits a semantic mismatch between XML entity resolution (used during sanitization) and HTML5 Named Character Reference resolution (used by the browser when the SVG is rendered inline). **This is a logic bug in svg-sanitize.

Remediation

Upgrade enshrined/svg-sanitize to 1.0.0 or later.

Affected PHP branches

{'branch': '8.3', 'fixed_in': '8.3.36', 'status': 'patched release available'}

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-9rjx-3jch-6vjf

← All threats