Vulnerability · Published Apr 17, 2026 · Assigned by GitHub_M

CVE-2026-40301rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives

Medium 4.7

In plain English

A medium-severity cross-site scripting in dom-sanitizer from rhukster. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.3%top 74.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.10, DOMSanitizer::sanitize() allows <style> elements in SVG content but never inspects their text content. CSS url() references and @import rules pass through unfiltered, causing the browser to issue HTTP requests to attacker-controlled hosts when the sanitized SVG is rendered. Version 1.0.10 fixes the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	rhukster/dom-sanitizer	1.0.10	GHSA-93vf-569f-22cq

Affected products (as reported)

Vendor	Product	Versions
rhukster	dom-sanitizer	< 1.0.10

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

References

https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-93vf-569f-22cq x_refsource_CONFIRM
https://github.com/rhukster/dom-sanitizer/commit/49a98046b708a4c92f754f5b0ef1720bb85142e2 x_refsource_MISC
https://github.com/rhukster/dom-sanitizer/releases/tag/1.0.10 x_refsource_MISC