AIKIDO-2026-911569

TL;DR

The DOM sanitizer validates href and xlink:href attribute URLs in its isDangerousUrl method. It rejects data: URLs only when they contain the literal substring onload, so payloads that Base64-encode their content slip past the check. Untrusted data: URLs carrying encoded HTML, SVG, or XHTML are treated as safe and preserved in the sanitized output, which can lead to cross-site scripting depending on how consumers render the result. The fix judges data: URLs by scheme and MIME type, permitting only inert image types and rejecting script-capable types regardless of encoding.