AIKIDO-2026-757794

rhukster/dom-sanitizer is vulnerable to Incomplete List of Disallowed Inputs

Incomplete List of Disallowed InputsGHSA-cjfg-j8jp-5xvc Published 2 days ago

Medium Risk

This Affects:

rhukster/dom-sanitizer

1.0.0 - 1.0.15

Fixed in 1.0.16

Are you affected? Scan for Free

TL;DR

The sanitizer normalizes CSS to strip comments and decode escape sequences before checking <style> blocks and style attributes, but SVG presentation attributes that carry CSS url() values are matched against their raw text. A CSS comment or hex escape placed between url( and the scheme defeats the external-URL regex while the browser's CSS tokenizer still decodes it into a live external reference. This lets obfuscated url() references in attributes such as fill, stroke, filter, clip-path, mask, and the marker attributes load attacker-controlled external resources, leaking viewer information and enabling tracking. The fix runs the same CSS normalizer on every url()-carrying attribute before the external-URL check so every path agrees.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you use it to sanitize untrusted SVG or style content whose presentation attributes can carry CSS url() references.