Threats tagged 'ghsa-4rvh-48q4-5726'

The darylldoyle svg-sanitizer library versions from 1.0.0 up to but not including 1.1.0 contain a regular expression denial of service (ReDoS) vulnerability. This flaw exists in the image-set pattern of the stripRemoteCssTokens() function when the removeRemoteReferences option is enabled. An attacker can craft SVG files with many unclosed image-set tokens to exhaust CPU resources or trigger PCRE limits, causing the sanitize() function to throw a TypeError and potentially leave unsanitized content.