svg-sanitizer before version 1.1.0 performs a costly sanitization routine that repeatedly scans the entire SVG content while removing PHP tags. This loop executes a quadratic number of preg_replace operations for SVG files containing many overlapping PHP tag delimiters, consuming CPU cores for extended periods and effectively disabling the service for legitimate users.

The vulnerability affects the darylldoyle svg-sanitizer project, specifically releases from 0.5.3 through any pre‑1.1.0 tag. Users running these versions and accepting user‑generated SVG uploads are exposed.

With a CVSS score of 8.7, the flaw is considered high severity and can be triggered by unauthenticated attackers who supply crafted SVG files. Because the EPSS score is unavailable and the vulnerability is not listed in CISA's KEV catalog, the exploit likelihood is uncertain; however, the lack of authentication and the potentially large impact on service availability make it a significant risk. The attack vector is inferred to be a file upload path that hands SVGs to svg‑sanitizer without additional validation. If exploited, the server could be rendered unresponsive for minutes, allowing the attacker to cause a denial of service.