{"id":"GHSA-8rc5-hx3v-2jg7","aliases":["CVE-2019-10772","SNYK-PHP-ENSHRINEDSVGSANITIZE-536969"],"title":"Sanitizer bypass in svg-sanitizer","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the \"xlink:href\" attribute due to mishandling of the xlink namespace by the sanitizer.","severity":"medium","score":6.1,"published":"2020-02-27T20:36:29.000Z","modified":"2026-09-10T03:49:25.215Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"enshrined/svg-sanitize","sources":[{"name":"OSV · GHSA-8rc5-hx3v-2jg7","url":"https://osv.dev/vulnerability/GHSA-8rc5-hx3v-2jg7"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.13.1"}],"type":"ECOSYSTEM"}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.10.0","0.11.0","0.12.0","0.13.0","0.2.0","0.2.1","0.3.0","0.4.0","0.4.1","0.5.0","0.5.1","0.5.2","0.5.3","0.5.3.1","0.6.0","0.7.0","0.7.1","0.7.2","0.8.0","0.8.1","0.8.2","0.9.0","0.9.1","0.9.2"],"fixed":["0.13.1"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2019-10772","https://github.com/darylldoyle/svg-sanitizer/commit/6add43e5c5649bc40e3afcb68c522720dcb336f9","https://snyk.io/vuln/SNYK-PHP-ENSHRINEDSVGSANITIZE-536969"],"sources":[{"name":"OSV","id":"GHSA-8rc5-hx3v-2jg7","modified":"2026-09-10T03:49:25.215067669Z","url":"https://osv.dev/vulnerability/GHSA-8rc5-hx3v-2jg7"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T19:20:37.165Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}