CVE-2026-103687: Incomplete Blacklist in rhukster dom-sanitizer
A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.16 is sufficient to fix this issue. The name of the patch is 139c46c3d7c9bc81542b7b5a58d5cde5d0e0195a. Upgrading the affected component is recommended.
AI Analysis
Technical Summary
The vulnerability CVE-2026-103687 affects the rhukster dom-sanitizer component, specifically the url function in src/DOMSanitizer.php related to SVG Sanitization. The flaw is due to an incomplete blacklist implementation, which can be manipulated remotely. Exploit details have been publicly disclosed. The vulnerability is resolved by upgrading to version 1.0.16, with the patch identified by commit 139c46c3d7c9bc81542b7b5a58d5cde5d0e0195a.
Potential Impact
An attacker can remotely exploit the incomplete blacklist in the url function to bypass sanitization controls, potentially leading to security issues related to SVG content processing. The CVSS 4.0 base score is 6.9 (medium severity), indicating a significant but not critical risk.
Mitigation Recommendations
Upgrade the rhukster dom-sanitizer component to version 1.0.16, which contains the official fix for this vulnerability. This upgrade fully addresses the incomplete blacklist issue in the SVG Sanitization component.
CVE-2026-103687: Incomplete Blacklist in rhukster dom-sanitizer
Description
A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.16 is sufficient to fix this issue. The name of the patch is 139c46c3d7c9bc81542b7b5a58d5cde5d0e0195a. Upgrading the affected component is recommended.
CVSS v4.0
Score 6.9medium
Affected software
rhukster
dom-sanitizer
pkg:github/rhukster/dom-sanitizercpe:2.3:a:rhukster:dom-sanitizer:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-103687 affects the rhukster dom-sanitizer component, specifically the url function in src/DOMSanitizer.php related to SVG Sanitization. The flaw is due to an incomplete blacklist implementation, which can be manipulated remotely. Exploit details have been publicly disclosed. The vulnerability is resolved by upgrading to version 1.0.16, with the patch identified by commit 139c46c3d7c9bc81542b7b5a58d5cde5d0e0195a.
Potential Impact
An attacker can remotely exploit the incomplete blacklist in the url function to bypass sanitization controls, potentially leading to security issues related to SVG content processing. The CVSS 4.0 base score is 6.9 (medium severity), indicating a significant but not critical risk.
Mitigation Recommendations
Upgrade the rhukster dom-sanitizer component to version 1.0.16, which contains the official fix for this vulnerability. This upgrade fully addresses the incomplete blacklist issue in the SVG Sanitization component.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-10-01T09:31:35.763Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6abe747ca43b0b3b89bcd657
Added to database: 10/01/2026, 14:55:56 UTC
Last enriched: 10/01/2026, 15:09:02 UTC
Last updated: 10/01/2026, 23:46:04 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.