6.1
MediumCVSS 3.1 · from VulnCheck
CVE-2026-116802
DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode
DOMPurify · Cross-site scripting · CWE-79AffectedDOMPurify
FixUpdate to 3.4.17 or newer
PublishedOct 26, 23:05 · VulnCheck
ScoredOct 26 · 6.1 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
Description
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName="href" and a javascript: entry in values to execute script when users click the sanitized link.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inDOMPurifybefore 3.4.173.4.17DOMPurifyNot affected3.4.17
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known