CVE-2026-107380: enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

A crafted SVG bypasses enshrined/svg-sanitize’s href validation and delivers a javascript: URL through the sanitizer unchanged. The bypass exploits a semantic mismatch between XML entity resolution (used during sanitization) and HTML5 Named Character Reference resolution (used by the browser when the SVG is rendered inline).

This is a logic bug in svg-sanitize. It does NOT depend on any PHP ext/dom bug — it works on any PHP version.

Affected installations:

• enshrined/svg-sanitize: 45.2M Packagist downloads, 1.3M/month, 90+ dependents
• WordPress Safe SVG plugin: 1M+ active installs (inline SVG rendering via themes)
• TYPO3, Drupal and 90+ other Packagist dependents