GitHub Advisoryadvisory · Packagist
GHSA-22wq-q86m-83fh svg-sanitizer Bypasses Attribute Sanitization
MEDIUM
Official page ↗
- Aliases
- CVE-2025-55166
- Ecosystem
- Packagist
- Packages
- enshrined/svg-sanitize
- Severity
- Moderate
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- Weaknesses
- CWE-601, CWE-79
- Reviewed
- 2025-08-12
Affected packages
• Packagist enshrined/svg-sanitize: < 0.22.0 → fixed in 0.22.0
Description
Problem
The sanitization logic at https://github.com/darylldoyle/svg-sanitizer/blob/0.21.0/src/Sanitizer.php#L454-L481 only searches for lower-case attribute names (e.g. `xlink:href` instead of `xlink:HrEf`), which allows to by-pass the `isHrefSafeValue` check. As a result this allows cross-site scripting or linking to external domains.
Proof-of-concept
_provided by azizk_
```
Click me
```
Credits
The mentioned findings and proof-of-concept example were reported to the TYPO3 Security Team by the external security researcher `azizk `.
Related
Alias · CVE (1)
- CVE-2025-55166 savg-sanitizer is a PHP SVG/XML sanitizer. vulnerability
References
- https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-22wq-q86m-83fh web
- https://nvd.nist.gov/vuln/detail/CVE-2025-55166 advisory
- https://github.com/darylldoyle/svg-sanitizer/commit/0afa95ea74be155a7bcd6c6fb60c276c39984500 web
- https://github.com/darylldoyle/svg-sanitizer/commit/5a0a1eaf0c6b0b540dc945fe30c93cf106b357c1 web
- https://github.com/darylldoyle/svg-sanitizer package
- https://github.com/darylldoyle/svg-sanitizer/blob/0.21.0/src/Sanitizer.php#L454-L481 web
- https://github.com/darylldoyle/svg-sanitizer/releases/tag/0.22.0 web