CVE-2026-103686: rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting
A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 1.0.16 is recommended to address this issue. Patch name: 4623b565d060bc02ca5a07d8c8241fe28e2edfda. It is suggested to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rhukster/dom-sanitizerto a version that resolves this vulnerability.Fixed in 1.0.16Patch 4623b565d060bc02ca5a07d8c8241fe28e2edfda
Event History
Frequently Asked Questions
Which versions should be treated as affected, and what version fixes the issue?
rhukster dom-sanitizer versions up to and including 1.0.15 are affected. Upgrade to version 1.0.16, which is recommended as the remediation.
What access does an attacker need to exploit this issue?
The attack can be initiated remotely, but the published severity vector indicates low privileges and user interaction are required. The issue affects URL validation in DOMSanitizer::isDangerousUrl and can lead to cross-site scripting.
Is exploit code available?
Yes. The exploit has been published and may be used.
How can I identify whether my application is exposed?
Check whether the application depends on composer/rhukster/dom-sanitizer and determine its installed version. Deployments using version 1.0.15 or earlier should be considered affected.