CVE-2026-103686CWE-79CWE-94cross-site-scriptingcode-injection

CVE-2026-103686

Low · published October 1, 2026

CVSS v3.1

3.5

EPSS

Percentile

29.1

In the wild

Unconfirmed

What it is

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 1.0.16 is recommended to address this issue. Patch name: 4623b565d060bc02ca5a07d8c8241fe28e2edfda. It is suggested to upgrade the affected component.

The record

Technical detail

CVSS v3.1: 3.5 · LOW
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0: 5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS: 0.00365 · 29.1th percentile
Weaknesses: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published: 2026-10-01T18:17Z

References (8)

https://github.com/rhukster/dom-sanitizer/ · [email protected]https://github.com/rhukster/dom-sanitizer/commit/4623b565d060bc02ca5a07d8c8241fe28e2edfda · [email protected]https://github.com/rhukster/dom-sanitizer/releases/tag/1.0.16 · [email protected]https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-mrpv-6x26-mf6c · [email protected]https://vuldb.com/cve/CVE-2026-103686 · [email protected]https://vuldb.com/submit/958312 · [email protected]https://vuldb.com/vuln/412550 · [email protected]https://vuldb.com/vuln/412550/cti · [email protected]

EPSS history

Timeline

03 OCT 03:41Z
EPSS moved — → 0%
epss
01 OCT 13:45Z
rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting
cvelistv5