CVE-2026-40301: rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives

April 10, 2026 (updated April 24, 2026)

DOMSanitizer::sanitize() allows elements in SVG content but never inspects their text content. CSS url() references and @import rules pass through unfiltered, causing the browser to issue HTTP requests to attacker-controlled hosts when the sanitized SVG is rendered.

References

github.com/advisories/GHSA-93vf-569f-22cq
github.com/rhukster/dom-sanitizer/commit/49a98046b708a4c92f754f5b0ef1720bb85142e2
github.com/rhukster/dom-sanitizer/releases/tag/1.0.10
github.com/rhukster/dom-sanitizer/security/advisories/GHSA-93vf-569f-22cq
nvd.nist.gov/vuln/detail/CVE-2026-40301

Code Behaviors & Features

Detect and mitigate CVE-2026-40301 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →