CVE-2023-46035: svg_optimizer Ruby Gem XXE Vulnerability

CVE-2023-46035 Overview

CVE-2023-46035 affects the svg_optimizer Ruby gem before version 0.3.0. The gem performs XML entity expansion on untrusted documents when processing Scalable Vector Graphics (SVG) files. An attacker can supply a crafted SVG containing nested entity definitions to trigger excessive resource consumption or exposure of sensitive data during parsing. The vulnerability is classified under CWE-776 (Improper Restriction of Recursive Entity References in DTDs, also known as XML Entity Expansion or Billion Laughs).

Critical Impact
Applications that pass user-supplied SVG files to svg_optimizer before 0.3.0 can leak confidential data through entity resolution or exhaust memory and CPU during document parsing.

Affected Products

svg_optimizer Ruby gem versions prior to 0.3.0
Ruby applications that invoke svg_optimizer on untrusted SVG input
Web services that accept user-uploaded SVG documents for optimization

Discovery Timeline

2026-09-14 - CVE-2023-46035 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2023-46035

Vulnerability Analysis

The svg_optimizer gem parses SVG documents as XML. Prior to version 0.3.0, the parser resolves entity declarations found in the document's Document Type Definition (DTD). An attacker supplying an SVG file with recursively nested entity references forces the parser to expand each reference, producing an exponential increase in memory and CPU consumption. This class of flaw is commonly referred to as a Billion Laughs attack. The same entity resolution behavior also enables reference to external content, expanding the potential impact beyond resource exhaustion.

Root Cause

The root cause is the parser configuration used by svg_optimizer to read SVG input. Entity expansion is not disabled before untrusted documents are loaded. Because SVG is XML-based, any DTD-defined internal entities are resolved and substituted during parsing. Without a hard limit on expansion depth or total expanded size, a small input can produce gigabytes of in-memory strings.

Attack Vector

An attacker delivers a crafted SVG file to any endpoint that hands the file to svg_optimizer. Common delivery paths include avatar uploaders, asset pipelines, and image-processing microservices. No authentication is required when the target endpoint accepts anonymous uploads. Exploitation requires attacker-controlled document content but no interaction beyond submission. Version 0.3.0 addresses the flaw by disabling entity expansion during parsing, as tracked in svg_optimizer pull request #17 and ruby-advisory-db pull request #713.

The vulnerability manifests during XML parsing when the gem encounters entity declarations in the DTD prolog of a submitted SVG. See the referenced pull requests for the specific parser hardening applied in the fix.

Detection Methods for CVE-2023-46035

Indicators of Compromise

SVG uploads containing <!DOCTYPE> declarations with nested <!ENTITY> definitions
Ruby worker processes showing sustained high memory or CPU while handling image uploads
Application logs recording Nokogiri or REXML parser errors correlated with SVG processing
Outbound network requests originating from the image-processing service during SVG parsing

Detection Strategies

Inspect inbound SVG payloads at the application boundary for DTD and entity declarations before invoking the gem
Query the software bill of materials (SBOM) or Gemfile.lock files for svg_optimizer versions below 0.3.0
Add runtime instrumentation around SVG processing to alert on parse durations exceeding a baseline threshold

Monitoring Recommendations

Track process memory growth during image handling and alert on anomalous spikes
Log the size and MIME type of uploaded files and correlate parse failures with source IP addresses
Monitor unexpected DNS or HTTP requests originating from application workers immediately after SVG uploads

How to Mitigate CVE-2023-46035

Immediate Actions Required

Upgrade the svg_optimizer gem to version 0.3.0 or later in all Ruby applications
Audit application entry points that accept SVG or XML input and confirm the resolved gem version
Reject inbound SVG documents containing <!DOCTYPE> or <!ENTITY> declarations at the ingress layer

Patch Information

The fix is delivered in svg_optimizer 0.3.0 through the change merged in pull request #17. The advisory metadata is tracked in the ruby-advisory-db entry. Update Gemfile constraints to gem 'svg_optimizer', '>= 0.3.0' and run bundle update svg_optimizer.

Workarounds

Preprocess SVG uploads with a sanitizer that strips DTDs and entity declarations before optimization
Run SVG processing in an isolated worker with strict memory and CPU limits to bound resource impact
Restrict outbound network access from image-processing workers to prevent external entity resolution

bash

# Update the gem to the patched release
bundle update svg_optimizer
bundle list | grep svg_optimizer