GHSA-93vf-569f-22cq: rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives

April 10, 2026

DOMSanitizer::sanitize() allows elements in SVG content but never inspects their text content. CSS url() references and @import rules pass through unfiltered, causing the browser to issue HTTP requests to attacker-controlled hosts when the sanitized SVG is rendered.

References

github.com/advisories/GHSA-93vf-569f-22cq
github.com/rhukster/dom-sanitizer
github.com/rhukster/dom-sanitizer/commit/49a98046b708a4c92f754f5b0ef1720bb85142e2
github.com/rhukster/dom-sanitizer/releases/tag/1.0.10
github.com/rhukster/dom-sanitizer/security/advisories/GHSA-93vf-569f-22cq

Code Behaviors & Features

Detect and mitigate GHSA-93vf-569f-22cq with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →