rhukster dom-sanitizer CVE-2026-103687

Exploitation requires an application that uses rhukster dom-sanitizer ≤1.0.15 to sanitize attacker-supplied SVG (DOMSanitizer::SVG mode, or HTML mode containing inline SVG), then serves that output to be rendered by a browser. The specific vectors are SVG presentation attributes carrying CSS url() values - fill, stroke, filter, clip-path, mask, marker-* - where a CSS comment (/**/) or hex escape (e.g. \2f\2f, \64 ata:) placed between url( and the scheme defeats the raw regex while the browser's CSS tokenizer still resolves the external reference. Limiting factors: the sanitizer output must actually be rendered client-side for impact to materialize, and same-document fragment references like url(#grad) and plain paint values are unaffected; no authentication or special privileges are needed to submit the malicious SVG.

This is a sanitizer-bypass flaw (CWE-184, incomplete blacklist) in the rhukster dom-sanitizer PHP library, not a direct code-execution bug. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L, score 6.9) describes network-reachable, low-complexity, unauthenticated abuse with low confidentiality, integrity and availability impact - consistent with a filter that lets attacker-controlled SVG slip an external resource reference past sanitization. The E:P (Proof-of-Concept) exploit-maturity flag aligns with the public GHSA advisory and the committed regression tests, so a working bypass is documented. No EPSS score and no CISA KEV entry are provided, and there is no evidence of active exploitation - the signal is 'public exploit code exists' rather than 'exploited in the wild.' Net: a real, patch-now hygiene issue for anyone relying on this library to neutralize untrusted SVG, but the capped L/L/L impact and the requirement that the sanitized output actually be rendered in a victim browser keep it below critical. Reporter is VulDB; the authoritative source is the vendor's own GitHub security advisory and patch commit, which strengthens confidence in the technical details.

An attacker submits an SVG containing a presentation attribute such as fill, stroke, mask, clip-path or filter whose url() value hides an external scheme behind a CSS comment or hex escape (e.g. fill="url(\2f\2f evil.example/x)" or url(/**/ //evil.example/x)). The raw regex blacklist fails to match the obfuscated value and passes it through, but the browser's CSS tokenizer decodes it and resolves the live external reference when the sanitized SVG is rendered. Public proof-of-concept vectors are documented in advisory GHSA-cjfg-j8jp-5xvc and the patch's regression tests.