CVE-2026-100370: DOMSanitizer - Incomplete data: URL Sanitization in DOMSanitizer::isDangerousUrl() Allows Base64-Encoded Payloads to Bypass href and xlink:href Validation
DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl() method is responsible for rejecting dangerous URL values in the href and xlink:href attributes. The weakness is that "javascript:" is rejected as a scheme, while "data:" is rejected only when the literal substring onload appears in the URL value (/^data:.onload/i). Because data: payloads are routinely Base64-encoded, the dangerous content (<script>, event handlers, etc.) is invisible to that substring test. A URL such as data:text/html;base64,… therefore survives in href / xlink:href, even though the decoded payload is active markup. This is an incomplete input-validation / sanitization defect in the sanitizer itself. This issue has been patched in version 1.0.15.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DOMSanitizerto a version that resolves this vulnerability.Fixed in 1.0.15
Event History
Frequently Asked Questions
Which deployments are affected?
DOMSanitizer versions prior to 1.0.15 are affected where untrusted content is sanitized and href or xlink:href values can be retained in the resulting DOM, SVG, or MathML.
What does an attacker need to exploit this issue?
An attacker needs to supply crafted content containing an href or xlink:href data: URL whose active markup is Base64-encoded. Exploitation also requires a user to interact with the resulting link or reference.
How can we determine whether our application is exposed?
Check the installed DOMSanitizer version and review whether the application passes attacker-controlled markup through it while allowing href or xlink:href attributes. Versions before 1.0.15 may allow Base64-encoded data: URLs to survive sanitization.
What should be done if an immediate upgrade is not possible?
Prevent untrusted href and xlink:href values from using the data: scheme, or remove those attributes from untrusted content before it is rendered. Upgrade to version 1.0.15 when possible.