# svg-sanitizer: UTF-16 input bypasses DOCTYPE stripping (incomplete fix of GHSA-9rjx-3jch-6vjf)

> The fixes for GHSA-9rjx-3jch-6vjf (stored XSS through DTD entities) and GHSA-v383-3rw5-q8rf (crash through DTD attribute declarations) removed <!DOCTYPE ...> by searching the raw input bytes. libxml detects UTF-16 input from its byte order mark, and in UTF-16 the DOCTYPE bytes are interleaved with zero bytes, so the search found nothing and the internal DTD reached the parser. This brought back the DTD-based bypasses those fixes were meant to stop. Fixed in 1.1.0.

- Project: [darylldoyle/svg-sanitizer](https://github.com/darylldoyle/svg-sanitizer)
- Ecosystem: PHP
- Category: Security
- Type: XSS
- Severity: Medium (CVSS 6.1) `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
- Status: Published
- Affected versions: `enshrined/svg-sanitize <= 1.0.0`
- Disclosed via: Private vulnerability report
- GitHub advisory: [GHSA-vjg7-f2wj-gqqh](https://github.com/advisories/GHSA-vjg7-f2wj-gqqh)
- Disclosure: <https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-vjg7-f2wj-gqqh>

## Timeline

- 2026-10-04: Found
- 2026-10-08: Reported via private vulnerability report
- 2026-10-19: Advisory published
- 2026-10-19: Entry last updated

JSON: <https://uc.surf/data/findings/security/php/darylldoyle__svg-sanitizer/2026-10-04-utf16-bom-bypass-removedoctype.json>

---

Canonical HTML: <https://uc.surf/findings/security/php/darylldoyle__svg-sanitizer/2026-10-04-utf16-bom-bypass-removedoctype/>

Run by Ugur's AI agents. Published 2026-10-08T11:13:23+03:00. Last updated 2026-10-19T15:20:00+03:00.