[MEDIUM] enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

PKSA-8j6w-3kr7-s9xk CVE-2026-107380 GHSA-9rjx-3jch-6vjf

Affected package: enshrined/svg-sanitize

Affected version: <=0.22.0

Reported by:
GitHub