CVE-2026-103686 in dom-sanitizer
Summary
by MITRE • 10/01/2026
A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 1.0.16 is recommended to address this issue. Patch name: 4623b565d060bc02ca5a07d8c8241fe28e2edfda. It is suggested to upgrade the affected component.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in rhukster dom-sanitizer versions up to 1.0.15 represents a critical failure in input validation and output encoding mechanisms, specifically within the URL sanitization logic. This flaw resides in the DOMSanitizer::isDangerousUrl function located in the src/DOMSanitizer.php file. The core technical issue stems from an insufficient check for dangerous protocols or malformed URLs that can bypass standard security filters. When a user-supplied input is processed through this component, the sanitizer fails to correctly identify and neutralize malicious payloads disguised as legitimate hyperlinks. This oversight allows attackers to inject scripts into web pages viewed by other users, leading directly to cross-site scripting attacks. The vulnerability highlights a common pitfall in library development where edge cases involving protocol handlers or encoded characters are not adequately handled during the sanitization process.
From an operational perspective, this flaw enables remote code execution via script injection without requiring any form of authentication from the victim user. An attacker can craft a specially crafted URL that, when processed by the vulnerable component, results in the execution of arbitrary JavaScript within the context of the affected website. This capability allows for session hijacking, credential theft, defacement of web pages, or redirection to malicious sites. The impact is severe because it compromises the integrity and confidentiality of user data interacting with the application. Since the exploit has been published and is actively available in public repositories, automated scanning tools and threat actors are likely already leveraging this weakness against systems running unpatched versions. This significantly increases the risk profile for any organization relying on this library for DOM manipulation tasks.
The technical classification of this vulnerability aligns with CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). Specifically, it relates to scenarios where input validation is bypassed due to incomplete filtering rules. In the context of the MITRE ATT&CK framework, this flaw facilitates techniques associated with Client-side Injection and potentially Drive-by Compromise if combined with other vectors like phishing links that trigger the vulnerable code path upon page load. The lack of robust protocol verification allows for the use of javascript: or data: URI schemes to execute scripts, bypassing traditional HTTP-based security controls.
To mitigate this risk, immediate action is required by upgrading rhukster dom-sanitizer to version 1.0.16 or later. This update includes specific patches designed to harden the URL validation logic and close the gap that allowed for script injection. The patch identifier associated with this fix is 4623b565d060bc02ca5a07d8c8241fe28e2edfda, which should be verified during deployment to ensure the correct codebase is applied. Organizations utilizing this library in their technology stack must prioritize updating dependencies through their package managers or manual replacement processes. Additionally, implementing a Web Application Firewall with rules targeting XSS patterns can provide an additional layer of defense while patching efforts are underway. Regular auditing of third-party libraries and maintaining up-to-date dependency trees are essential practices to prevent similar vulnerabilities from impacting production environments in the future.