PT-2026-32980 · Unknown · Domsanitizer

Published 2026-04-10 · Updated 2026-04-18 · CVE-2026-40301

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions DOMSanitizer versions prior to 1.0.10

Description The sanitize() function allows style elements in SVG content without inspecting their text content. This allows CSS url() references and @import rules to pass through unfiltered, which can cause a browser to issue HTTP requests to attacker-controlled hosts when the sanitized SVG is rendered. An attacker can use this to exfiltrate the page URL to an external server, load arbitrary external stylesheets, or potentially exfiltrate cookie or session token values using CSS attribute selectors.

Recommendations Update to version 1.0.10.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-40301

GHSA-93VF-569F-22CQ

Affected Products

Domsanitizer

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-40301 · Security Note
• https://osv.dev/vulnerability/GHSA-93vf-569f-22cq · Vendor Advisory
• https://github.com/rhukster/dom-sanitizer/releases/tag/1.0.10 · Note
• https://github.com/rhukster/dom-sanitizer · Note
• https://github.com/rhukster/dom-sanitizer/commit/49a98046b708a4c92f754f5b0ef1720bb85142e2 · Note
• https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-93vf-569f-22cq · Note
• https://twitter.com/CVEnew/status/2045467394772967669 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2045273385798660444 · Twitter Post