CVE-2026-103687

{
  "etk_id": "ETK-2026-2369",
  "cve_id": "CVE-2026-103687",
  "display_id": "CVE-2026-103687",
  "ghsa_id": "GHSA-cjfg-j8jp-5xvc",
  "euvd_id": "EUVD-2026-90850",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SVG URL filtering bypass in rhukster/dom-sanitizer",
  "summary": "rhukster/dom-sanitizer before 1.0.16 can fail to remove obfuscated external CSS URL references in SVG presentation attributes. An attacker who can supply HTML or SVG for sanitization may cause external resources to remain referenced in sanitized output.",
  "mitigation": "Upgrade rhukster/dom-sanitizer to version 1.0.16 or later. Until upgrading, do not accept untrusted SVG content or remove SVG presentation attributes that can contain CSS URLs before sanitization.",
  "vendor": "composer",
  "product": "composer:rhukster/dom-sanitizer",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "1.0.15"
      ],
      "ecosystem": "composer",
      "fixed_versions": [
        "1.0.16"
      ],
      "package_name": "rhukster/dom-sanitizer",
      "purl": "pkg:composer/rhukster/dom-sanitizer"
    }
  ],
  "cwes": [
    184
  ],
  "cvss_score": 7.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 8.212304283333333,
  "t0_at": "2026-10-01T14:30:12.624000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-21T23:16:12.865046+00:00",
      "days": 20.365280567662037,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T14:30:12.624000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-09-01T23:26:34+00:00",
      "days": -29.62753037037037,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T14:30:12.624000+00:00",
      "url": "https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-cjfg-j8jp-5xvc"
    },
    "trigger_signal": {
      "at": "2026-10-01T14:30:12.624000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T14:30:12.624000+00:00",
      "url": "https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-cjfg-j8jp-5xvc"
    }
  }
}