CVE-2026-103687

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-103687

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103687.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-103687

Aliases

GHSA-cjfg-j8jp-5xvc

Published

2026-10-01T14:30:12Z

Modified

2026-10-03T03:46:10Z

Severity

5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklist

Details

A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.16 is sufficient to fix this issue. The name of the patch is 139c46c3d7c9bc81542b7b5a58d5cde5d0e0195a. Upgrading the affected component is recommended.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-183",
        "CWE-184"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103687.json"
}

References

Affected packages

Git / github.com/rhukster/dom-sanitizer

Affected ranges

Type

GIT

Repo

https://github.com/rhukster/dom-sanitizer

Events

Introduced

e88e914ac405cfc303edd31440621971b5e33902

Fixed

139c46c3d7c9bc81542b7b5a58d5cde5d0e0195a

Fixed

f0eb17834e2fb52d9610aebcceaf5009d183cc86

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "1.0.0"
        },
        {
            "last_affected":  "1.0.0"
        },
        {
            "introduced":  "1.0.1"
        },
        {
            "last_affected":  "1.0.1"
        },
        {
            "introduced":  "1.0.2"
        },
        {
            "last_affected":  "1.0.2"
        },
        {
            "introduced":  "1.0.3"
        },
        {
            "last_affected":  "1.0.3"
        },
        {
            "introduced":  "1.0.4"
        },
        {
            "last_affected":  "1.0.4"
        },
        {
            "introduced":  "1.0.5"
        },
        {
            "last_affected":  "1.0.5"
        },
        {
            "introduced":  "1.0.6"
        },
        {
            "last_affected":  "1.0.6"
        },
        {
            "introduced":  "1.0.7"
        },
        {
            "last_affected":  "1.0.7"
        },
        {
            "introduced":  "1.0.8"
        },
        {
            "last_affected":  "1.0.8"
        },
        {
            "introduced":  "1.0.9"
        },
        {
            "last_affected":  "1.0.9"
        },
        {
            "introduced":  "1.0.10"
        },
        {
            "last_affected":  "1.0.10"
        },
        {
            "introduced":  "1.0.11"
        },
        {
            "last_affected":  "1.0.11"
        },
        {
            "introduced":  "1.0.12"
        },
        {
            "last_affected":  "1.0.12"
        },
        {
            "introduced":  "1.0.13"
        },
        {
            "last_affected":  "1.0.13"
        },
        {
            "introduced":  "1.0.14"
        },
        {
            "last_affected":  "1.0.14"
        },
        {
            "introduced":  "1.0.15"
        },
        {
            "last_affected":  "1.0.15"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

Other

1.*

1.0.0

1.0.1

1.0.10

1.0.11

1.0.12

1.0.13

1.0.14

1.0.15

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103687.json"