DOMSanitizer does not inspect the contents of <style> tags embedded in SVG files, allowing attackers to inject CSS url() references and @import directives. When the sanitized SVG is rendered in a browser, those unfiltered directives trigger HTTP requests to attacker‑controlled hosts. The vulnerability can lead to covert exfiltration of data or unexpected network traffic, but it does not provide direct code execution or privilege escalation. The CVSS score of 4.7 indicates a moderate impact.

The flaw is present in the rhukster:dom‑sanitizer library for PHP 7.3 and above prior to release version 1.0.10. Any PHP application that uses DOMSanitizer::sanitize() and renders SVG content could be affected.

The moderate CVSS score combined with the lack of an official KEV listing suggests that exploitation frequency is low to moderate. An attacker would need to supply or influence SVG content that is processed by DOMSanitizer and subsequently rendered in a browser, making the vulnerability highly context‑dependent. Without the patch, browsers will still perform network requests based on the malformed styles, which could be detected if outbound traffic is monitored.