What is the CVSS score of CVE-2026-40301?

CVE-2026-40301 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40301?

Yes, a patch is available for CVE-2026-40301. Update the affected software to the latest version immediately.

PHP CVE-2026-40301

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-17 GitHub_M

XSS PHP

4.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.7 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 18, 2026 - 02:30 nvd

Patch available

Analysis Generated

Apr 17, 2026 - 21:37 vuln.today

Analysis Generated

Apr 17, 2026 - 21:15 vuln.today

CVE Published

Apr 17, 2026 - 20:51 nvd

MEDIUM 4.7

DescriptionGitHub Advisory

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.10, DOMSanitizer::sanitize() allows <style> elements in SVG content but never inspects their text content. CSS url() references and @import rules pass through unfiltered, causing the browser to issue HTTP requests to attacker-controlled hosts when the sanitized SVG is rendered. Version 1.0.10 fixes the issue.

AnalysisAI

DOMSanitizer before version 1.0.10 fails to sanitize CSS content within SVG <style> elements, allowing attackers to inject url() references and @import rules that trigger unauthorized HTTP requests to attacker-controlled hosts when the sanitized SVG is rendered in a browser. This affects PHP applications using the vulnerable library to sanitize user-supplied SVG content, enabling information disclosure through request metadata and potential CSRF attacks. The vulnerability requires user interaction (rendering the SVG) but affects all downstream users of the sanitized content due to scope change (C:L, S:C).

Technical ContextAI

DOMSanitizer is a PHP library designed to sanitize DOM, SVG, and MathML content by removing potentially dangerous elements and attributes. The vulnerability exists in the sanitization logic for SVG <style> elements, which the library permits but does not inspect for CSS rules that can trigger network requests. CSS url() functions in properties like background-image, and @import rules within <style> blocks, are processed by browsers as absolute resource references regardless of origin. When a browser renders the sanitized SVG, it automatically fetches these resources, causing side-channel information leakage (via HTTP request parameters, referer headers, cookies) and enabling CSRF attacks against authenticated sessions. The root cause is inadequate input validation (CWE-79: Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting). The library's allowlist approach for SVG elements included <style> but lacked corresponding inspection of its text content.

RemediationAI

Upgrade DOMSanitizer to version 1.0.10 or later immediately. Update the Composer dependency with composer update rhukster/dom-sanitizer to pull the patched version. The fix inspects and sanitizes CSS content within SVG <style> elements, filtering url() and @import rules. If immediate upgrade is infeasible, implement a temporary compensating control: strip all <style> elements from SVG content before passing to DOMSanitizer (trade-off: legitimate SVG styling will be lost), or disable rendering of user-supplied SVG entirely pending patching. For applications that must accept user SVG and preserve styling, validate CSS rules against a strict allowlist before rendering (e.g., forbid url() and @import, allow only primitive properties like fill, stroke, opacity). Monitor composer.lock for DOMSanitizer version and enable automated dependency updates or security alerts via GitHub Dependabot.