Live › vulnerability › CVE-2026-116802
Go to dashboardDOMPurify before 3.4.17 fails to block SVG animate or set elements that target href when the parser media type is application/xhtml+xml, because attribute names are not lowercased. An attacker can supply a javascript: URL through SMIL values and run script in the page when a user clicks the sanitized link.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Applications that use DOMPurify before 3.4.17 to sanitize user-supplied SVG or HTML, and that set the parser media type to application/xhtml+xml, are exposed. Apps using the default HTML parser mode or that do not accept SVG input are less likely to be affected, but the sources do not confirm this.
No product ranges from the sources yet.
npm ls dompurify or in the lockfile.application/xhtml+xml alongside SVG input.3.4.17 or later.application/xhtml+xml parser media type.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName="href" and a javascript: entry in values to execute script when users click the sanitized link.
This page as .md · .json · in your agent: get_signal("CVE-2026-116802")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.