Update enshrined/svg-sanitize [#3542254]

Problem/Motivation

The composer.json for this module requires enshrined/svg-sanitize at version >=0.15. A security notice is posted for versions <0.22

Fix: Update the composer.json to the secure minimum value:

    "require": {
        "enshrined/svg-sanitize": ">=0.22 <1.0"
    }

Steps to reproduce

Proposed resolution

Update dependencies in composer.json

Remaining tasks

User interface changes

API changes

Data model changes

Comment	File	Size	Author
	svg_image-sec-issue-184085-1.patch	500 bytes	fathershawn

Issue fork svg_image-3542254

Show commands

Start within a Git clone of the project using the version control instructions.

Add & fetch this issue fork’s repository

Or, if you do not have SSH keys set up on git.drupalcode.org:

Add & fetch this issue fork’s repository

3542254-update-enshrined-svg-sanitize changes, plain diff MR !50
Check out this branch for the first time

Check out existing branch, if you already have it locally

About issue forks

Comments

Comment #1

20 August 2025 at 14:05

fathershawn created an issue. See original summary.

Comment #2

mably commented 20 August 2025 at 14:34

Category:

Bug report

» Task

Hi @fathershawn, thanks for your patch.

Could you create a MR please?

Comment #3

damienmckenna

TN, USA

commented 21 August 2025 at 00:14

Issue tags:

+Security improvements

FYI because the module's composer constraints allow individual site maintainers to upgrade their site to a secure version of the dependency (enshrined/svg-sanitize) it fits within the jurisdiction of PSA-2011-002 so no advisory is needed for this. That said, I've tagged this as a "security improvement" as it is important to encourage site owners to upgrade, and many won't until their modules require it.