Skip to content
OpenAdvisories

Vendor

rhukster

4 known vulnerabilities.

Products

dom-sanitizer 4
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.7
    CVE-2026-100370

    DOMSanitizer - Incomplete data: URL Sanitization in DOMSanitizer::isDangerousUrl() Allows Base64-Encoded Payloads to Bypass href and xlink:href Validation

    DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl() method is responsible for rejecting dangerous URL values in the href and xlink:href attributes. The weakness is that "javascript:" is rejected as a scheme, …

    rhukster dom-sanitizer
  • Medium 4.7
    CVE-2026-40301

    rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives

    DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.10, DOMSanitizer::sanitize() allows <style> elements in SVG content but never inspects their text content. CSS url() references and @import rules pass through unfiltered, causing th…

    rhukster dom-sanitizer rhukster/dom-sanitizer Packagist