CVE-2026-100370

DOMSanitizer - Incomplete data: URL Sanitization in DOMSanitizer::isDangerousUrl() Allows Base64-Encoded Payloads to Bypass href and xlink:href Validation

View on CVE.org

Published Sep 28, 2026 CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Description

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl() method is responsible for rejecting dangerous URL values in the href and xlink:href attributes. The weakness is that "javascript:" is rejected as a scheme, while "data:" is rejected only when the literal substring onload appears in the URL value (/^data:.*onload/i). Because data: payloads are routinely Base64-encoded, the dangerous content (<script>, event handlers, etc.) is invisible to that substring test. A URL such as data:text/html;base64,… therefore survives in href / xlink:href, even though the decoded payload is active markup. This is an incomplete input-validation / sanitization defect in the sanitizer itself. This issue has been patched in version 1.0.15.

Analysis

Technical impact

DOMSanitizer performs input validation against href and xlink:href attributes, but its isDangerousUrl() function mistakenly allows data: URLs that are Base64‑encoded to bypass the onload substring check. Because the malicious payload inside the data URL is hidden until decoded, the sanitization fails and the contained script or event handler can execute, leading to a cross‑site scripting vulnerability.

Affected Systems

The vulnerability affects the rhukster:dom‑sanitizer package, specifically all versions prior to 1.0.15. The library is used in PHP applications that sanitize DOM, SVG, or MathML content.

Risk and Exploitability

The CVSS score of 4.7 indicates moderate severity; the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation. Based on the description, the likely attack vector involves an attacker feeding crafted link attributes into the sanitizer, which is a local or remote injection depending on how the library is used. The weakness is an input‑validation flaw (CWE‑20).

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

rhukster

dom-sanitizer

affected

Version	Status	Constraints
`< 1.0.15`	affected	—

No data.

Vendor Product Versions

Rhukster

Dom-sanitizer

Version	Status	Scheme	Platform
`[0,1.0.15)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade rhukster:dom‑sanitizer to version 1.0.15 or newer, which removes the permissive data: URL check.
If upgrading is not possible, configure the application to reject all data: URLs before they reach the sanitizer or de‑code and validate them explicitly.
Add an additional layer of input validation in your code that ensures no data: URLs contain untrusted or executable content before passing values to the library.

Generated by OpenCVE AI on September 28, 2026 at 21:25 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.274% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/rhukster/dom-sanitizer/commit/10f97807e4501d60f63987f2e76a38cdbf312dcb
https://github.com/rhukster/dom-sanitizer/commit/fb8f758b41134fc5fb2f563666f2330c69e31f94
https://github.com/rhukster/dom-sanitizer/releases/tag/1.0.15
https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-wcj2-r6vg-rm97

History

Sep 28, 2026 10:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Rhukster Rhukster dom-sanitizer
Vendors & Products		Rhukster Rhukster dom-sanitizer

Sep 28, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 28, 2026 8:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl() method is responsible for rejecting dangerous URL values in the href and xlink:href attributes. The weakness is that "javascript:" is rejected as a scheme, while "data:" is rejected only when the literal substring onload appears in the URL value (/^data:.*onload/i). Because data: payloads are routinely Base64-encoded, the dangerous content (<script>, event handlers, etc.) is invisible to that substring test. A URL such as data:text/html;base64,… therefore survives in href / xlink:href, even though the decoded payload is active markup. This is an incomplete input-validation / sanitization defect in the sanitizer itself. This issue has been patched in version 1.0.15.
Title		DOMSanitizer - Incomplete data: URL Sanitization in DOMSanitizer::isDangerousUrl() Allows Base64-Encoded Payloads to Bypass href and xlink:href Validation
Weaknesses		CWE-20
References		https://github.com/rhukster/dom-sanitizer/commit/10f97807e4501d60f63987f2e76a38cdbf312dcb https://github.com/rhukster/dom-sanitizer/commit/fb8f758b41134fc5fb2f563666f2330c69e31f94 https://github.com/rhukster/dom-sanitizer/releases/tag/1.0.15 https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-wcj2-r6vg-rm97
Metrics		cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N'}`