| शीर्षक | rhukster dom-sanitizer <= 1.0.15 Improper Input Validation |
|---|
| विवरण | rhukster/dom-sanitizer is a widely used PHP HTML and SVG sanitization library designed to secure applications—including popular CMS platforms like Grav—against cross-site scripting (XSS) and malicious payload injections.
This advisory details a security bypass vulnerability affecting dom-sanitizer versions <= 1.0.15. The vulnerability stems from an overly restrictive scheme-validation gate in isDangerousUrl(), which exclusively targets href and xlink:href attributes. Consequently, other URL-bearing attributes in the default allow-list—most notably form action—fail to undergo dangerous scheme validation, allowing javascript: and arbitrary data: URIs to survive sanitization unhindered. This enables an attacker to construct a submittable form with a javascript: action, leading to Stored Cross-Site Scripting (XSS) upon user interaction.
For complete technical details, including the Root Cause Analysis (RCA), exact affected code paths, and full Steps to Reproduce (PoC), please refer to the official, publicly disclosed GitHub Security Advisory linked below |
|---|
| स्रोत | ⚠️ https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-mrpv-6x26-mf6c |
|---|
| उपयोगकर्ता | 0xMo-Error (UID 100917) |
|---|
| सबमिशन | 03/09/2026 05:22 PM (29 दिन पहले) |
|---|
| संयम | 01/10/2026 11:31 AM (28 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 412550 [rhukster dom-sanitizer तक 1.0.15 URL Validation src/DOMSanitizer.php isDangerousUrl क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|