Composer enshrined/svg-sanitize has 7 known advisories in the phpwarden feed. Feed 2026.10.29.3, updated 2026-10-29.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2019-18857 | XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes | high | 7.5 | <0.12.0 | 0.12.0 |
| CVE-2019-10772 | Sanitizer bypass in svg-sanitizer | medium | 6.1 | <0.13.1 | 0.13.1 |
| CVE-2022-23638 | Cross-site Scripting in enshrined/svg-sanitize | medium | 6.2 | <0.15.0 | 0.15.0 |
| CVE-2026-107379 | enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash | medium | 6.5 | <1.0.0 | 1.0.0 |
| CVE-2025-55166 | svg-sanitizer Bypasses Attribute Sanitization | medium | 0.0 | <0.22.0 | 0.22.0 |
| CVE-2026-107381 | svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences | medium | 6.5 | <1.0.0 | 1.0.0 |
| CVE-2026-107380 | enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision | medium | 5.4 | <1.0.0 | 1.0.0 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden deps composer.lock # or, without Composer pipx install phpwarden && phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked