CVE-2026-100370

MediumCVSS 4.7

Published: 28/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 29/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl() method is responsible for rejecting dangerous URL values in the href and xlink:href attributes. The weakness is that "javascript:" is rejected as a scheme, while "data:" is rejected only when the literal substring onload appears in the URL value (/^data:.*onload/i). Because data: payloads are routinely Base64-encoded, the dangerous content is invisible to that substring test. A URL such as data:text/html;base64,… therefore survives in href / xlink:href, even though the decoded payload is active markup. This is an incomplete input-validation / sanitization defect. Patched in version 1.0.15.

Risk Assessment

An attacker can exploit this vulnerability to inject malicious code (XSS) via href or xlink:href attributes, potentially leading to session hijacking or data theft.

Recommendation

Upgrade DOMSanitizer to version 1.0.15 or later, which includes the fix.

Other vulnerabilities in DOMSanitizer

CVE-2026-40301Medium
DOMSanitizer (PHP 7.3+) before 1.0.10 allows <style> elements in SVG content but never inspects their text content. CSS url() references and @import rules pass through unfiltered, causing the browser to issue HTTP requests to attacker-controlled hosts when the sanitized SVG is rendered.

Original NVD description (English source)

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl() method is responsible for rejecting dangerous URL values in the href and xlink:href attributes. The weakness is that "javascript:" is rejected as a scheme, while "data:" is rejected only when the literal substring onload appears in the URL value (/^data:.*onload/i). Because data: payloads are routinely Base64-encoded, the dangerous content (<script>, event handlers, etc.) is invisible to that substring test. A URL such as data:text/html;base64,… therefore survives in href / xlink:href, even though the decoded payload is active markup. This is an incomplete input-validation / sanitization defect in the sanitizer itself. This issue has been patched in version 1.0.15.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS