SVG Sanitization Flaw in Rhukster DOM-Sanitizer Affects Multiple Versions
CVE-2026-103687

6.9MEDIUM

Key Information:

Vendor

Rhukster

Status
Dom-sanitizer
Vendor
CVE Published:
1 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-103687?

A vulnerability exists in the Rhukster DOM-Sanitizer component related to SVG sanitization. The flaw lies in the handling of the function 'url' in the src/DOMSanitizer.php file, which creates an incomplete blacklist for input validation. This allows a potential attacker to exploit the vulnerability remotely. It has been publicly disclosed, and users are advised to upgrade to version 1.0.16, which includes a patch identified by commit 139c46c3d7c9bc81542b7b5a58d5cde5d0e0195a, to mitigate this risk.

Affected Version(s)

dom-sanitizer 1.0.0

dom-sanitizer 1.0.1

dom-sanitizer 1.0.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-103687 - Proof of Concept

References

https://vuldb.com/vuln/412551
vdb-entrytechnical-description
https://vuldb.com/vuln/412551/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-103687
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

0xMo-Error (VulDB User)
.