AIKIDO-2026-452100

TL;DR

The HTML/SVG sanitizer validates dangerous URL schemes only on the href and xlink:href attributes. Other URL-bearing attributes such as action, cite, poster, src, srcset, and background skip scheme validation entirely, so a javascript: or scriptable data: URI placed in one of them survives sanitization. A crafted form with a javascript: action passes through as a complete, submittable form whose submission executes the payload, yielding stored cross-site scripting. The fix applies scheme validation to every URL-bearing attribute, judges each srcset candidate on its own, and widens the post-serialization regex coverage to the same attribute set.