Description

The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-14T06:16:54.500Z",
  "pubdate": "2026-09-14T06:16:54.500Z",
  "executiveSummary": "The svg_optimizer gem, in versions prior to 0.3.0, is susceptible to an XML External Entity (XXE) injection vulnerability. This flaw arises from the improper configuration of the underlying XML parser, which allows for unauthorized entity expansion within untrusted SVG documents.\nBy injecting malicious XML entities, an attacker can coerce the application into processing external references. The primary impact of this vulnerability includes unauthorized disclosure of sensitive local files, server-side request forgery (SSRF), and potential denial-of-service (DoS) conditions through entity expansion attacks (e.g., Billion Laughs attack).\nThis vulnerability affects all Ruby environments utilizing versions of the svg_optimizer gem before 0.3.0. Exploitation does not require prior authentication, and the impact is contingent on the privileges of the application process. Organizations leveraging this gem to process user-supplied SVG files are at high risk of data exfiltration and should prioritize updating the library to secure versions.",
  "technicalDetails": "The root cause of the vulnerability in svg_optimizer is the failure to disable Document Type Definition (DTD) processing and external entity resolution in the XML parser used to process input files. When the gem parses an SVG—which is fundamentally an XML-based format—it performs entity expansion by default. If the underlying library is not explicitly configured to ignore external DTDs and entities, the XML parser will attempt to resolve references defined within the document's DOCTYPE declaration.\nThe exploitation flow typically begins with an attacker crafting a malicious SVG file containing a DOCTYPE header that defines an external entity pointing to a sensitive file on the host filesystem (e.g., /etc/passwd) or an internal network resource. When the victim application invokes the svg_optimizer gem to optimize or process the uploaded SVG, the parser interprets the malicious entity. Upon encountering the entity reference within the document body, the parser retrieves the content from the specified URI and substitutes it into the document content.\nIn scenarios involving local file inclusion, the exfiltrated content may be returned to the attacker through the application's output or error messages if the processed XML data is rendered or reflected back to the user. In SSRF scenarios, the attacker can use the parser to interact with internal services that are otherwise not accessible from the public internet, potentially bypassing firewalls or authentication mechanisms.\nFurthermore, the vulnerability allows for recursive entity expansion. An attacker can define nested entities that expand exponentially, leading to excessive memory and CPU consumption. This results in an effective Denial-of-Service (DoS) condition, crashing the Ruby process or exhausting system resources. Because the vulnerability is inherent to the parsing logic and does not require elevated privileges or authentication, the attack surface is exposed whenever the application processes untrusted input. The lack of input validation or sanitization regarding DTDs means that any application incorporating the vulnerable gem as a library is immediately exposed to these vectors."
}