CVE-2026-40301: DOMSanitizer XSS Vulnerability

CVE-2026-40301 Overview

DOMSanitizer is a DOM/SVG/MathML Sanitizer library for PHP 7.3 and later versions. Prior to version 1.0.10, the DOMSanitizer::sanitize() function allows <style> elements within SVG content but fails to inspect their text content. This oversight permits CSS url() references and @import rules to pass through the sanitizer unfiltered. When the sanitized SVG is rendered in a browser, these malicious CSS directives cause the browser to issue HTTP requests to attacker-controlled hosts, enabling information disclosure attacks.

Critical Impact

Attackers can embed malicious CSS within SVG content to exfiltrate user information or track user activity through unauthorized HTTP requests to external servers when sanitized SVG files are rendered.

Affected Products

• DOMSanitizer for PHP 7.3+ versions prior to 1.0.10
• Applications using vulnerable DOMSanitizer versions to process SVG content
• Web applications rendering user-supplied SVG files through DOMSanitizer

Discovery Timeline

• 2026-04-17 - CVE CVE-2026-40301 published to NVD
• 2026-04-20 - Last updated in NVD database

Technical Details for CVE-2026-40301

Vulnerability Analysis

This vulnerability is classified as Cross-Site Scripting (CWE-79) due to the improper neutralization of input during web page generation. The core issue lies in the incomplete sanitization logic within DOMSanitizer. While the library correctly handles many dangerous elements and attributes in SVG content, it overlooks the potential for malicious content within <style> element text nodes.

The sanitizer allows <style> elements to pass through when processing SVG files, which is necessary for legitimate SVG styling. However, it does not parse or filter the CSS content within these elements. This creates a gap where attackers can craft SVG files containing CSS directives that reference external resources.

When a browser renders the sanitized SVG, it processes the embedded CSS, which can include url() functions pointing to attacker-controlled servers or @import rules that fetch external stylesheets. These requests leak information such as the user's IP address, user agent, and potentially session identifiers through URL parameters.

Root Cause

The root cause is the failure of DOMSanitizer::sanitize() to recursively inspect and filter the text content within <style> elements during SVG processing. The sanitization logic focuses on element structure and attributes but treats text nodes within style elements as safe content that doesn't require filtering.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious SVG file that contains CSS with external resource references. When this SVG is uploaded to an application using the vulnerable DOMSanitizer library and subsequently rendered to users, the embedded CSS triggers outbound HTTP requests.

The attack scenario involves:

1. An attacker creates an SVG file with a <style> element containing CSS url() or @import directives pointing to their server
2. The SVG is processed by an application using vulnerable DOMSanitizer versions
3. The malicious CSS passes through sanitization unchanged
4. When victims view the rendered SVG, their browsers make requests to the attacker's server
5. The attacker captures information from these requests for tracking or reconnaissance

This attack requires network access and user interaction (the victim must view the rendered SVG), but no privileges are required on the target system. The vulnerability enables cross-origin information disclosure through CSS-based exfiltration techniques.

Detection Methods for CVE-2026-40301

Indicators of Compromise

• SVG files containing <style> elements with url() functions referencing external domains
• CSS @import rules within SVG style elements pointing to suspicious URLs
• Outbound HTTP requests originating from rendered SVG content to unknown external hosts
• Unexpected network traffic patterns when users view SVG images

Detection Strategies

• Implement content security policies (CSP) that restrict external resource loading from SVG content
• Monitor web application logs for uploaded SVG files containing style elements with external references
• Deploy network monitoring to detect anomalous outbound requests triggered by rendered web content
• Perform static analysis of uploaded SVG files to identify CSS directives with external URL references

Monitoring Recommendations

• Configure web application firewalls to inspect SVG uploads for suspicious CSS patterns
• Enable detailed logging for SVG file processing operations
• Monitor DNS queries for unusual patterns that may indicate CSS-based data exfiltration
• Implement alerting for outbound connections initiated by browser rendering of user-uploaded content

How to Mitigate CVE-2026-40301

Immediate Actions Required

• Upgrade DOMSanitizer to version 1.0.10 or later immediately
• Audit existing sanitized SVG content in your application for malicious CSS directives
• Implement Content Security Policy headers to restrict external resource loading
• Review and sanitize any cached SVG files that were processed with vulnerable versions

Patch Information

The vulnerability has been addressed in DOMSanitizer version 1.0.10. The fix is available through the GitHub Release for Version 1.0.10. Technical details of the fix can be reviewed in the commit 49a98046b708a4c92f754f5b0ef1720bb85142e2. Additional information is available in the GitHub Security Advisory GHSA-93vf-569f-22cq.

Workarounds

• Strip all <style> elements from SVG content before or after sanitization as a temporary measure
• Implement additional CSS content filtering to remove url() and @import directives
• Serve user-uploaded SVG files with restrictive CSP headers that prevent external resource loading
• Consider converting SVG files to raster formats (PNG, JPEG) when rendering user-uploaded content is required

# Update DOMSanitizer via Composer
composer require rhukster/dom-sanitizer:^1.0.10