PatchClock

PHP security digest · Packages

enshrined/svg-sanitize security advisories

3 advisories we have followed since September 2026, newest first. Each page says who is affected, which versions fix it and how to check your project.

  1. Medium 8 Oct 2026

    enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

    Fixed in 1.0.0 · CVE-2026-107380

  2. Medium 8 Oct 2026

    svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences

    Fixed in 1.0.0 · CVE-2026-107381

  3. Medium 8 Oct 2026

    enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

    Fixed in 1.0.0 · CVE-2026-107379

Check your project in one command

Composer compares your composer.lock with the public advisory databases:

composer audit

It lists every installed package with a known advisory, including enshrined/svg-sanitize, and the version that fixes it.