PHPSeverity: MediumStatus: Published

svg-sanitizer: UTF-16 input bypasses DOCTYPE stripping (incomplete fix of GHSA-9rjx-3jch-6vjf)

The fixes for GHSA-9rjx-3jch-6vjf (stored XSS through DTD entities) and GHSA-v383-3rw5-q8rf (crash through DTD attribute declarations) removed <!DOCTYPE …> by searching the raw input bytes. libxml detects UTF-16 input from its byte order mark, and in UTF-16 the DOCTYPE bytes are interleaved with zero bytes, so the search found nothing and the internal DTD reached the parser. This brought back the DTD-based bypasses those fixes were meant to stop. Fixed in 1.1.0.