CVE-2023-49146: 
PHP vulnerability analysis and mitigation

DOMSanitizer (aka dom-sanitizer) before version 1.0.7 contains a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via an SVG document due to improper handling of comments and greedy regular expressions (NVD).

The vulnerability exists due to mishandling of comments and greedy regular expressions when processing SVG documents. The issue was assigned a CVSS v3.1 Base Score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating that it can be exploited remotely without privileges but requires user interaction (NVD).

If successfully exploited, this vulnerability could allow attackers to execute arbitrary web scripts in the context of the victim's browser session when processing SVG documents. This could lead to theft of sensitive information, session hijacking, or other malicious actions within the scope of the affected application (NVD).

The vulnerability has been fixed in version 1.0.7 of DOMSanitizer. Users are advised to upgrade to this version or later to address the security issue. The fix addresses the handling of comments and greedy regular expressions in SVG document processing (GitHub Patch).