Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

rhukster/dom-sanitizer

2 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
2 · 1 medium
Registry
Packagist

Advisories 2

  • CVE-2026-40301Medium 4.7

    rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives

    Affected: fixed in 1.0.10.

  • DOMSanitizer (aka dom-sanitizer) before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular…

    Affected: fixed in 1.0.7.