The vulnerability originates from an incomplete blacklist in the URL handling function of the SVG Sanitization component. The flaw allows a malicious user to supply crafted SVG content that bypasses the sanitization logic, potentially enabling injection of code or scripts that could be executed by downstream consumers. The associated weaknesses are encoded in CWE‑183 (Incorrect Encoding or Escaping) and CWE‑184 (Code Injection), indicating that improper handling of user input may lead to unauthorized execution.

The affected product is rhukster dom‑sanitizer, with all releases up to and including 1.0.15 impacted. The fix is bundled in release 1.0.16 and is identified by commit 139c46c3d7c9bc81542b7b5a58d5cde5d0e0195a.

The CVSS score for this flaw is 6.9, indicating medium severity. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. The advisory explicitly states that the attack can be launched remotely and that the exploit has been publicly disclosed, suggesting that an attacker could target any user of the unpatched component without the need for local privileges. Given the confirmed remote exploitability, prompt remediation is recommended.