Submit #958345: rhukster dom-sanitizer <= 1.0.15 Improper Input Validation

rhukster/dom-sanitizer is a widely used PHP HTML and SVG sanitization library designed to secure applications—including popular CMS platforms like Grav—against cross-site scripting (XSS) and malicious payload injections.

This advisory details a security bypass vulnerability affecting dom-sanitizer versions <= 1.0.15. The vulnerability is caused by an architectural asymmetry in CSS sanitization: while recent security hardening introduced robust normalization (normalizeCss() to neutralize CSS comments and hex-escape sequences) for <style> elements and inline style attributes, SVG presentation attributes that also carry CSS url() values (such as fill, stroke, filter, clip-path, mask, and marker-*) are still validated solely by a legacy, raw regex check (isExternalUrl()) without prior normalization.

Consequently, an attacker can bypass the filter by injecting CSS comments (/**/) or hex-escape sequences (\2f\2f) between url( and the malicious scheme (e.g., fill="url(\2f\2f evil.example/x)"). The browser's CSS tokenizer decodes these obfuscations into an active external reference, resulting in unintended outbound resource loading, user-agent/IP disclosure, and potential tracking or side-channel data exfiltration.

For complete technical details, including the Root Cause Analysis (RCA), vulnerable code paths, and full Steps to Reproduce (PoC), please refer to the official, publicly disclosed GitHub Security Advisory linked below

• Source: ⚠️ https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-cjfg-j8jp-5xvc
• User: 0xMo-Error (UID 100917)
• Submission: 09/03/2026 17:27 (29 days ago)
• Moderation: 10/01/2026 11:31 (28 days later)
• Status: Accepted
• VulDB entry: 412551 [rhukster dom-sanitizer up to 1.0.15 SVG Sanitization src/DOMSanitizer.php url incomplete blacklist]
• Points: 20