svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
Medium · CVSS 6.5
## Summary `Resolver::processReferences()` collects `<use>` elements with the XPath predicate `use[@href or @xlink:href]`, which is case sensitive. A `<use>` element written as `xlink:HrEf` is therefore never added to the reference graph, so the nesting-DoS nullification never marks it for removal. `Sanitizer::cleanHrefAttributes()` then runs later in the same pass and rewrites `xlink:HrEf` back to the canonical `xlink:href`. The sanitizer hands back a fully live nesting bomb that it would have stripped completely had the input used canonical casing.
Remediation
Upgrade enshrined/svg-sanitize to 1.0.0 or later.
Affected PHP branches
{'branch': '8.5', 'fixed_in': '8.5.12', 'status': 'patched release available'}
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-m9xh-6747-9r6f