SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

Vulnerability

SVGO, a Node.js library for optimizing SVG files, accepts XML with custom entities without adequate guards against expansion or recursion. This allows a small SVG (as small as 811 bytes) to cause exponential entity expansion, leading to high memory consumption and process stall or crash. The issue affects versions 2.1.0 to 2.8.1, 3.0.0 to 3.3.3, and before 4.0.1 [1][2].

Exploitation

An attacker can craft an SVG file containing nested entity definitions in the DOCTYPE, similar to the classic Billion Laughs attack. When SVGO attempts to parse such an SVG via its optimization pipeline, the entities expand recursively, consuming all available memory. The attack requires no authentication and can be delivered through any vector that causes SVGO to process the malicious SVG (e.g., user uploads, network input) [2].

Impact

Successful exploitation results in a denial of service: the SVGO process hangs or crashes with a JavaScript heap out-of-memory error. This can disrupt server-side applications that rely on SVGO for processing user-supplied SVGs. Local usage on trusted SVGs is unlikely to be affected [2].

Mitigation

Patches are available in SVGO versions 2.8.1, 3.3.3, and 4.0.1. Users are strongly advised to upgrade immediately. For those unable to upgrade, input validation to reject SVGs containing DOCTYPE entity declarations may serve as a temporary workaround [1][2].