The rhukster dom-sanitizer library for PHP versions before 1.0.10 improperly neutralizes input during web page generation by allowing <style> elements in SVG content without sanitizing their text content. This enables CSS url() and @import directives to bypass filtering, leading to potential cross-site scripting scenarios where browsers issue requests to attacker-controlled domains when rendering sanitized SVGs. The vulnerability is addressed in version 1.0.10 of the library.

An attacker can craft SVG content containing malicious CSS that triggers the browser to load resources from attacker-controlled hosts. This can lead to information leakage such as user IP addresses or other metadata via these HTTP requests. The CVSS score of 4.7 indicates a medium impact primarily affecting confidentiality. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

Upgrade to rhukster dom-sanitizer version 1.0.10 or later, which fixes the issue by properly sanitizing the text content of <style> elements in SVGs. Since no official patch links or vendor advisory were provided, users should verify the version and update accordingly. Patch status is not yet confirmed by a vendor advisory; check the official project repository or vendor channels for the latest remediation guidance.