CVE-2023-46035

Published: Sep 14, 2026Modified: Sep 22, 2026Deferred

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.2 / Impact: 3.6

Source: MITRE (Secondary)

Description

The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.

Related CWEs

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

References (2)

https://github.com/fnando/svg_optimizer/pull/17

Source: cve@mitre.org

https://github.com/rubysec/ruby-advisory-db/pull/713

Source: cve@mitre.org

Timeline

No history available yet.