CVE-2026-103687

rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklist

State: Published
Severity: 6.9 Medium
Published: Oct 1, 2026
Updated: Oct 1, 2026
Reserved: Oct 1, 2026

Description

A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.16 is sufficient to fix this issue. The name of the patch is 139c46c3d7c9bc81542b7b5a58d5cde5d0e0195a. Upgrading the affected component is recommended.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	7.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-184 Incomplete Blacklist
CWE-183 Permissive List of Allowed Inputs

Affected Products

Product	Versions
dom-sanitizerrhukster	1.0.0Affected 1.0.1Affected 1.0.2Affected 1.0.3Affected 1.0.4Affected 1.0.5Affected 1.0.6Affected 1.0.7Affected 1.0.8Affected 1.0.9Affected 1.0.10Affected 1.0.11Affected 1.0.12Affected 1.0.13Affected 1.0.14Affected 1.0.15Affected 1.0.16Not affected

References

VDB-412551 | rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklistvdb-entrytechnical-description
VDB-412551 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-103687 | CVE Analysis and Reportthird-party-advisory
Submit #958345 | rhukster dom-sanitizer <= 1.0.15 Improper Input Validationthird-party-advisory
https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-cjfg-j8jp-5xvcexploit
https://github.com/rhukster/dom-sanitizer/commit/139c46c3d7c9bc81542b7b5a58d5cde5d0e0195apatch
https://github.com/rhukster/dom-sanitizer/releases/tag/1.0.16patch
https://github.com/rhukster/dom-sanitizer/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.