CVE-2026-107380 darylldoyle CVE debrief

Who should care

Defenders responsible for applications using the svg-sanitizer library, especially those embedding sanitized SVGs inline, should assess exposure and prioritize updates to version 1.0.0 or later.

Why it matters

Defenders should care about CVE-2026-107380 because it allows for stored XSS in applications using svg-sanitizer versions prior to 1.0.0, potentially leading to script execution in embedding pages. Roles responsible for updating libraries and monitoring application security should assess exposure and prioritize remediation.

• Script execution in embedding page's origin
• Potential for user-activated link exploitation
• Need for version verification and updates
• Importance of monitoring link activations

Technical summary

The svg-sanitizer library, prior to version 1.0.0, does not properly handle SVG href attributes after XML DTD entity expansion and during inline HTML rendering. This can lead to stored XSS vulnerabilities when an application embeds sanitized SVGs inline. Specifically, the isHrefSafeValue() function validates an SVG href after XML DTD entity expansion, but saveXML() serializes the original entity reference after removing the DTD declaration. A crafted entity can appear to the sanitizer as a safe fragment prefix while HTML5 Named Character Reference resolution during inline HTML rendering later converts the surviving reference to whitespace, potentially exposing a javascript: URL.

Defensive priority

Defenders should prioritize updating the svg-sanitizer library to version 1.0.0 or later, and review applications that embed sanitized SVGs inline to assess exposure.

Recommended defensive actions

• Update svg-sanitizer to version 1.0.0 or later
• Review applications embedding sanitized SVGs inline to assess exposure
• Monitor for suspicious link activations in embedding pages
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and fixed version. However, the corpus does not establish versions beyond those provided, exploitation, impact, or remediation beyond updating to version 1.0.0 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.