# rhukster/dom-sanitizer (Packagist) vulnerabilities 2 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/rhukster/dom-sanitizer ## Advisories (2) ### [CVE-2026-40301](https://cve.now/CVE-2026-40301): rhukster/dom-sanitizer: SVG \ tag allows CSS injection via unfiltered url() and @import directives - Severity: Medium 4.7 - Published: Apr 17, 2026 - Affected: fixed in 1.0.10. ### [CVE-2023-49146](https://cve.now/CVE-2023-49146): DOMSanitizer (aka dom-sanitizer) before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular… - Severity: Unrated - Published: Nov 22, 2023 - Affected: fixed in 1.0.7. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/rhukster/dom-sanitizer Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.