All vulnerabilities
CVE-2026-116802GHSA-c6gr-qvv4-5v3f

DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode

cure53 DOMPurifynpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.1Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in3.4.17Fixed versionCVE List
Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

  • 3.4.17DOMPurifyCVE List
  • 3.4.17dompurify, npmOSVnpm install dompurify@3.4.17

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName="href" and a javascript: entry in values to execute script when users click the sanitized link.

Text from CVE List

Affected versions 3

  • DOMPurifyaffected: all versions before 3.4.17CVE List
  • DOMPurifyunaffected: 3.4.17CVE List
  • dompurify, npmfrom first release, fixed in 3.4.17OSV

References 2