CVE-2026-103686: Cross Site Scripting in rhukster dom-sanitizer
A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 1.0.16 is recommended to address this issue. Patch name: 4623b565d060bc02ca5a07d8c8241fe28e2edfda. It is suggested to upgrade the affected component.
AI Analysis
Technical Summary
A cross-site scripting vulnerability was identified in rhukster dom-sanitizer up to version 1.0.15, specifically in the DOMSanitizer::isDangerousUrl function responsible for URL validation. This flaw enables remote attackers to inject malicious scripts, leading to XSS attacks. The vulnerability is tracked as CVE-2026-103686 with a CVSS 4.0 base score of 5.1 (medium severity). A patch is available in version 1.0.16, which fixes the issue.
Potential Impact
Successful exploitation of this vulnerability allows remote attackers to perform cross-site scripting attacks by injecting malicious scripts through manipulated URLs. This can lead to user session hijacking, defacement, or other client-side impacts. The vulnerability requires low attack complexity and no privileges but does require user interaction.
Mitigation Recommendations
Upgrade rhukster dom-sanitizer to version 1.0.16, which contains the official fix for this vulnerability. Applying this update will remediate the cross-site scripting issue in the DOMSanitizer::isDangerousUrl function.
CVE-2026-103686: Cross Site Scripting in rhukster dom-sanitizer
Description
A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 1.0.16 is recommended to address this issue. Patch name: 4623b565d060bc02ca5a07d8c8241fe28e2edfda. It is suggested to upgrade the affected component.
CVSS v4.0
Score 5.1medium
Affected software
rhukster
dom-sanitizer
pkg:github/rhukster/dom-sanitizercpe:2.3:a:rhukster:dom-sanitizer:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
A cross-site scripting vulnerability was identified in rhukster dom-sanitizer up to version 1.0.15, specifically in the DOMSanitizer::isDangerousUrl function responsible for URL validation. This flaw enables remote attackers to inject malicious scripts, leading to XSS attacks. The vulnerability is tracked as CVE-2026-103686 with a CVSS 4.0 base score of 5.1 (medium severity). A patch is available in version 1.0.16, which fixes the issue.
Potential Impact
Successful exploitation of this vulnerability allows remote attackers to perform cross-site scripting attacks by injecting malicious scripts through manipulated URLs. This can lead to user session hijacking, defacement, or other client-side impacts. The vulnerability requires low attack complexity and no privileges but does require user interaction.
Mitigation Recommendations
Upgrade rhukster dom-sanitizer to version 1.0.16, which contains the official fix for this vulnerability. Applying this update will remediate the cross-site scripting issue in the DOMSanitizer::isDangerousUrl function.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-10-01T09:31:30.531Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6abe7484a43b0b3b89bd1006
Added to database: 10/01/2026, 14:56:04 UTC
Last enriched: 10/01/2026, 15:13:00 UTC
Last updated: 10/01/2026, 22:46:14 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.