svg-sanitizer versions 0.11.0 through 1.0.x contain an uncaught exception that occurs when Sanitizer::sanitize() processes well‑formed XML documents lacking a top‑level svg element. The method throws a LogicException instead of returning false, which causes calling processes to crash or to continue processing malformed data. The resulting loss of availability is consistent with a denial-of-service attack. The vulnerability is formally classified as CWE‑248, Uncaught Exception.

The affected product is svg‑sanitizer, developed by darylldoyle. All releases from 0.11.0 up to, but not including, 1.1.0 are susceptible. No specific non‑product versions are listed beyond those ranges.

The CVSS score is 6.9, indicating a moderate risk. EPSS data is not available, and the issue is not listed in CISA's KEV catalog. The attack requires supplying a specially crafted XML document to a system that uses svg‑sanitizer without additional exception handling. Because the trigger is well‑formed XML lacking a top‑level svg root, attackers could embed the payload in any context that submits XML to the sanitizer, such as upload services or content pipelines. The exploit surface is therefore likely to be exposed in environments where svg‑sanitizer is called directly or indirectly with user‑supplied content.