{"affected":[{"defaultStatus":"unaffected","product":"svg-sanitizer","source":"CNA: VulnCheck","vendor":"darylldoyle","versions":[{"lessThan":"1.1.0","status":"affected","version":"1.0.0","versionType":"semver"},{"status":"unaffected","version":"1.1.0","versionType":"semver"}]}],"cveId":"CVE-2026-121445","cwes":["CWE-754"],"description":"darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the image-set pattern of stripRemoteCssTokens() when removeRemoteReferences is enabled. Attackers can submit SVGs with many unclosed image-set tokens to exhaust CPU, or trigger PCRE limits causing sanitize() to throw a TypeError and leave unsanitized content.","epss":null,"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-94x8-pw3c-6qcq"}],"kev":null,"metrics":[{"score":8.2,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":5.9,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1793724979864,"publishedAt":1793716114674,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-94x8-pw3c-6qcq"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/svg-sanitizer-1.0.0-before-1.1.0-redos-and-fail-open-via-image-set-css-stripping"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-94x8-pw3c-6qcq"}],"remediation":[],"revision":"cd213fa92312a3b707ae150151093a261f63404d22f5a95bb8ad1c5a095e300e","sources":[{"modifiedAt":1793724979864,"name":"CNA: VulnCheck","retrievedAt":1793725906726,"url":"https://www.cve.org/CVERecord?id=CVE-2026-121445"}],"ssvc":{"assessedAt":1793724956736,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"svg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS Stripping","updatedAt":1793725906726}