Low severity · published Oct 1, 2026
CVE-2026-103686
rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting
3.5
CVSS
0.2%
EPSS
No
On KEV
Description
A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 1.0.16 is recommended to address this issue. Patch name: 4623b565d060bc02ca5a07d8c8241fe28e2edfda. It is suggested to upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
dom-sanitizer · rhukster
1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +10 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-103686
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-103686
vdb-entry
https://vuldb.com/vuln/412550
signature
https://vuldb.com/vuln/412550/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-103686
third-party-advisory
https://vuldb.com/submit/958312
exploit
https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-mrpv-6x26-mf6c
patch
https://github.com/rhukster/dom-sanitizer/commit/4623b565d060bc02ca5a07d8c8241fe28e2edfda
More from dom-sanitizer
7.3
CVE-2026-103687
rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklist
4.7
CVE-2026-100370
DOMSanitizer - Incomplete data: URL Sanitization in DOMSanitizer::isDangerousUrl() Allows Base64-Encoded Payloads to Bypass href and xlink:href Validation
4.7
CVE-2026-40301
rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives