The rhukster dom-sanitizer library for PHP versions prior to 1.0.10 contains a cross-site scripting (CWE-79) vulnerability. Specifically, the sanitize() method permits <style> elements within SVG content without inspecting the CSS text inside them. As a result, CSS constructs such as url() references and @import rules are not filtered, enabling an attacker to cause the browser to issue HTTP requests to attacker-controlled domains when the sanitized SVG is rendered. This behavior can lead to information leakage or other side effects related to cross-origin requests. The issue is resolved in version 1.0.10 of the library.

The vulnerability allows an attacker to embed malicious CSS within SVG content that is sanitized by vulnerable versions of dom-sanitizer. When the sanitized SVG is rendered in a browser, it can trigger HTTP requests to attacker-controlled servers via CSS url() or @import rules. This can lead to information disclosure such as leaking user browsing context or enabling tracking. The CVSS score of 4.7 reflects a medium severity with low confidentiality impact and no integrity or availability impact.

Upgrade to dom-sanitizer version 1.0.10 or later, where the sanitize() method properly inspects and filters CSS content inside <style> elements in SVG. Since the vendor advisory indicates the issue is fixed in version 1.0.10, applying this official fix is the recommended remediation. No other mitigations are specified or required.