CVE-2026-100370

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl() method is responsible for rejecting dangerous URL values in the href and xlink:href attributes. The weakness is that "javascript:" is rejected as a scheme, while "data:" is rejected only when the literal substring onload appears in the URL value (/^data:.*onload/i). Because data: payloads are routinely Base64-encoded, the dangerous content (<script>, event handlers, etc.) is invisible to that substring test. A URL such as data:text/html;base64,… therefore survives in href / xlink:href, even though the decoded payload is active markup. This is an incomplete input-validation / sanitization defect in the sanitizer itself. This issue has been patched in version 1.0.15.

• CWE-20

• https://github.com/rhukster/dom-sanitizer/commit/10f97807e4501d60f63987f2e76a38cdbf312dcb
• https://github.com/rhukster/dom-sanitizer/commit/fb8f758b41134fc5fb2f563666f2330c69e31f94
• https://github.com/rhukster/dom-sanitizer/releases/tag/1.0.15
• https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-wcj2-r6vg-rm97
• https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-wcj2-r6vg-rm97

Published

Sep 28, 2026

Last Modified

Sep 28, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10034The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable…5.3
• CVE-2026-10035The Turnkey bbPress by WeaverTheme plugin for WordPress is v…6.6
• CVE-2026-10036SpeechBrain before 1.1.1 contains an arbitrary code executio…8.8
• CVE-2026-100368CliInvoke is a .NET library for invoking command-line progra…8.4
• CVE-2026-100369CliInvoke and its formerly named `AlastairLundy.CliInvoke` p…8.4
• CVE-2026-10037A sandbox escape vulnerability exists in the OpenJDK package…8.8
• CVE-2026-100371InvoicePlane is a self-hosted open source application for ma…8.7
• CVE-2026-100372ClipBucket v5 before 5.5.3-#197 contains a path traversal vu…7.2
• CVE-2026-100373OpenMetadata through 2.0.2 contains a server-side request fo…4.1
• CVE-2026-100376Improper Neutralization of Input During Web Page Generation …4.8
• CVE-2026-100377Exposure of Sensitive Information to an Unauthorized Actor v…6.9
• CVE-2026-100378Missing Authorization vulnerability in Wikimedia Foundation …5.3