Is CVE-2026-107381 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107381 being exploited in the wild.

How severe is CVE-2026-107381?

Medium severity, with a CVSS score of 6.5, published 14 October 2026.

Which products and versions are affected?

Enshrined Svg-Sanitizer 0.22.0 and earlier; enshrined/svg-sanitize (Packagist) <= 0.22.0, ECOSYSTEM:introduced=0,fixed=1.0.0.

Is there a fix for CVE-2026-107381?

Yes. enshrined/svg-sanitize (Packagist): upgrade to 1.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107381 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107381?

Check whether you run Enshrined Svg-Sanitizer or enshrined/svg-sanitize (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107381: svg-sanitizer case-insensitive xlink:href DoS bypass

Q: Is there a fix for CVE-2026-107381?

Yes. enshrined/svg-sanitize (Packagist): upgrade to 1.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107381 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-107381?

Check whether you run Enshrined Svg-Sanitizer or enshrined/svg-sanitize (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107381 · Severity: medium · CVSS 6.5 · Published 2026-10-14

The svg-sanitizer library fails to block maliciously nested SVG `<use>` elements when they use mixed-case attribute names like `xlink:HrEf`. An attacker can upload an SVG with this bypassed nesting structure, and the library will output it unchanged with canonical casing, potentially causing a denial-of-service through recursive element expansion in downstream renderers.

Technologies: Enshrined Svg-Sanitizer, enshrined/svg-sanitize (Packagist). Vendors: Enshrined, Packagist.

Quick answers

Is CVE-2026-107381 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107381 being exploited in the wild.
How severe is CVE-2026-107381?: Medium severity, with a CVSS score of 6.5, published 14 October 2026.
Which products and versions are affected?: Enshrined Svg-Sanitizer 0.22.0 and earlier; enshrined/svg-sanitize (Packagist) <= 0.22.0, ECOSYSTEM:introduced=0,fixed=1.0.0.
Is there a fix for CVE-2026-107381?: Yes. enshrined/svg-sanitize (Packagist): upgrade to 1.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107381 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107381?: Check whether you run Enshrined Svg-Sanitizer or enshrined/svg-sanitize (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

enshrined/svg-sanitize (Packagist): upgrade to 1.0.0 or later
```
composer require enshrined/svg-sanitize:^1.0.0
```

Technical details

The vulnerability is a case-sensitivity mismatch: `Resolver::processReferences()` uses XPath with case-sensitive attribute selection `[@href or @xlink:href]`, but `Sanitizer::cleanHrefAttributes()` later normalizes mixed-case attribute names to lowercase. An attacker can bypass the nesting-DoS protection by submitting SVG with `xlink:HrEf` (mixed case), which is not caught by the reference graph but then normalized to `xlink:href` in the output, creating a live nesting bomb that should have been stripped. The fix requires either case-insensitive attribute matching in the XPath query or reordering the sanitizer pipeline so attribute normalization occurs before graph collection.

Affected products

enshrined svg-sanitizer 0.22.0 and earlier

Identifiers

CVE-2026-107381
GHSA-m9xh-6747-9r6f

Timeline

2026-10-08: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.