Is CVE-2026-121444 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121444 being exploited in the wild.

How severe is CVE-2026-121444?

High severity, with a CVSS score of 7.5, published 3 November 2026.

Which products and versions are affected?

Enshrined Svg-Sanitizer 0.11.0 to 1.0.0.

Is there a fix for CVE-2026-121444?

Yes: fixed in 1.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-121444 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-121444?

Check whether you run Enshrined Svg-Sanitizer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121444: svg-sanitizer algorithmic complexity denial of service in use reference-graph analysis

CVE-2026-121444 · Severity: high · CVSS 7.5 · Published 2026-11-03

svg-sanitizer is a PHP library that removes potentially harmful code from SVG (scalable vector graphics) files. The library contains a flaw in how it analyzes SVG elements that reference other elements, allowing attackers to upload a small malicious SVG file that causes the server to consume massive CPU resources for hours, disrupting service availability for legitimate users.

Technologies: Enshrined Svg-Sanitizer. Vendors: Enshrined.

Quick answers

Is CVE-2026-121444 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121444 being exploited in the wild.
How severe is CVE-2026-121444?: High severity, with a CVSS score of 7.5, published 3 November 2026.
Which products and versions are affected?: Enshrined Svg-Sanitizer 0.11.0 to 1.0.0.
Is there a fix for CVE-2026-121444?: Yes: fixed in 1.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121444 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-121444?: Check whether you run Enshrined Svg-Sanitizer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.1.0

Technical details

The vulnerability exists in the hasInfiniteLoop() and countUse() functions in src/ElementReference/Subject.php, which recursively enumerate all paths in an SVG reference graph without memoization. An attacker constructs a layered, acyclic directed graph with 15 nested levels where each node has multiple children pointing to the next layer, forcing the algorithm to explore approximately k^15 paths. Because the depth limit of 15 prevents the exception from firing at the boundary, there is no bounds check on exponential breadth, allowing a ~12 KB SVG to require tens of hours of CPU time during sanitization.

Affected products

enshrined svg-sanitizer 0.11.0 to 1.0.0

Timeline

2026-10-19: disclosed
2026-11-03: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.