CVE-2026-40301: rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives
(updated )
DOMSanitizer::sanitize() allows elements in SVG content but never inspects their text content. CSS url() references and @import rules pass through unfiltered, causing the browser to issue HTTP requests to attacker-controlled hosts when the sanitized SVG is rendered.
References
- github.com/advisories/GHSA-93vf-569f-22cq
- github.com/rhukster/dom-sanitizer
- github.com/rhukster/dom-sanitizer/commit/49a98046b708a4c92f754f5b0ef1720bb85142e2
- github.com/rhukster/dom-sanitizer/releases/tag/1.0.10
- github.com/rhukster/dom-sanitizer/security/advisories/GHSA-93vf-569f-22cq
- nvd.nist.gov/vuln/detail/CVE-2026-40301
Code Behaviors & Features
Detect and mitigate CVE-2026-40301 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →