Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.10, DOMSanitizer::sanitize() allows <style> elements in SVG content but never inspects their text content. CSS url() references and @import rules pass through unfiltered, causing the browser to issue HTTP requests to attacker-controlled hosts when the sanitized SVG is rendered. Version 1.0.10 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
CVE-2026-40301 DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.10, DOMSanitizer::sanitize() allows <style> elements in SVG content but never inspects t… https://www.cve.org/CVERecord?id=CVE-2026-40301
Post summary
CVE-2026-40301 exposes a DOM sanitization flaw that allows <style> tags in SVG content before patch version 1.0.10 of DOMSanitizer for PHP 7.3+, with the fix available in the mentioned version.
CVE-2026-40301 CSS Injection via Unfiltered Style Elements in DOMSanitizer Below 1.0.10 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40301
Post summary
The snippet announces a CSS injection vulnerability in DOMSanitizer versions older than 1.0.10, with a Vulmon reference, but provides no PoC, exploit, or patch details.