CVE-2026-103687

43th percentile - higher than 43% of all known CVEs

A vulnerability has been found in rhukster dom-sanitizer up to version 1.0.15. The affected element is the url function in src/DOMSanitizer.php of the SVG Sanitization component. Manipulation leads to an incomplete blacklist, allowing remote exploitation. The exploit has been publicly disclosed and may be used.

An attacker can remotely bypass the SVG sanitization mechanism and inject malicious content, potentially leading to script execution in the victim's browser or other attacks. The publicly available exploit increases the risk.

Update the dom-sanitizer library to version 1.0.16 or later, which contains the fix (patch 139c46c3d7c9bc81542b7b5a58d5cde5d0e0195a). Immediate update is recommended due to the publicly known exploit.