Threats affecting pkg:github/rhukster/dom-sanitizer

A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.16 is sufficient to fix this issue. The name of the patch is 139c46c3d7c9bc81542b7b5a58d5cde5d0e0195a. Upgrading the affected component is recommended.

CVE-2026-103686 is a cross-site scripting (XSS) vulnerability in the rhukster dom-sanitizer component, specifically in the DOMSanitizer::isDangerousUrl function within src/DOMSanitizer.php. This flaw affects versions up to and including 1.0.15 and allows remote attackers to execute malicious scripts. The vulnerability has a medium severity score of 5.1. An exploit has been published but no known widespread exploitation is reported. Upgrading to version 1.0.16 addresses this issue.

DOMSanitizer versions prior to 1.0.15 have an input validation flaw in the isDangerousUrl() method. The sanitizer rejects 'javascript:' URLs but only partially rejects 'data:' URLs by checking for the literal substring 'onload'. Because data: payloads are often Base64-encoded, dangerous content can bypass this check and remain in href or xlink:href attributes. This incomplete sanitization could allow active markup to persist. The issue is fixed in version 1.0.15.

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.10, DOMSanitizer::sanitize() allows <style> elements in SVG content but never inspects their text content. CSS url() references and @import rules pass through unfiltered, causing the browser to issue HTTP requests to attacker-controlled hosts when the sanitized SVG is rendered. Version 1.0.10 fixes the issue.