AIKIDO-2026-720464

TL;DR

DOMSanitizer runs its dangerous-CSS checks against the raw declaration without normalizing it first, so a CSS comment placed inside a token splits the value and hides @import, url(, and expression( from the checks, and a CSS escape can even synthesize a comment during decoding. The image-set() and -webkit-image-set() functions can also reference an external resource without ever writing url(, so no existing pattern matches them. When sanitized SVG or HTML is embedded inline, these bypasses let external resource references survive, causing the viewer's browser to fetch untrusted resources and disclose the viewer's IP address. The fix normalizes CSS by stripping comments before and after escape decoding and extends the checks to cover image-set() and -webkit-image-set() with external schemes while still allowing relative references.