{"id":"CVE-2026-116802","kind":"vulnerability","aliases":["CVE-2026-116802"],"related":[],"title":"DOMPurify: SMIL attribute case bypass lets SVG run script on click","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName=\"href\" and a javascript: entry in values to execute script when users click the sanitized link.","summary":"DOMPurify before 3.4.17 fails to block SVG animate or set elements that target href when the parser media type is application/xhtml+xml, because attribute names are not lowercased. An attacker can supply a javascript: URL through SMIL values and run script in the page when a user clicks the sanitized link.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dompurify","frontend","javascript","package","web-apps"],"not_affected_if":["default-config","no-svg-input"],"how_to_check":"- Check the installed DOMPurify version with `npm ls dompurify` or in the lockfile.\n- Look for calls that set PARSER_MEDIA_TYPE to `application/xhtml+xml` alongside SVG input.","fix":"- Upgrade DOMPurify to `3.4.17` or later.\n- Until upgraded, avoid sanitizing untrusted SVG with the `application/xhtml+xml` parser media type.","status":"open","published_at":"2026-10-27T00:17:11+00:00","first_seen_at":"2026-10-27T00:25:55+00:00","triaged_at":"2026-10-27T00:26:39+00:00","updated_at":"2026-10-27T00:26:39+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-27T00:26:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade DOMPurify to `3.4.17` or later.\n- Until upgraded, avoid sanitizing untrusted SVG with the `application/xhtml+xml` parser media type.","reach":"internet","title":"DOMPurify: SMIL attribute case bypass lets SVG run script on click","impact":"medium","summary":"DOMPurify before 3.4.17 fails to block SVG animate or set elements that target href when the parser media type is application/xhtml+xml, because attribute names are not lowercased. An attacker can supply a javascript: URL through SMIL values and run script in the page when a user clicks the sanitized link.","category":"package","nicknames":[],"who_cares":["dompurify","javascript","frontend","web-apps"],"confidence":0.75,"needs_auth":"no","worst_case":"Script runs in the victim's browser session after a click on a link","analyst_note":"","how_to_check":"- Check the installed DOMPurify version with `npm ls dompurify` or in the lockfile.\n- Look for calls that set PARSER_MEDIA_TYPE to `application/xhtml+xml` alongside SVG input.","needs_analyst":false,"not_affected_if":["default-config","no-svg-input"],"who_is_affected":"Applications that use DOMPurify before 3.4.17 to sanitize user-supplied SVG or HTML, and that set the parser media type to application/xhtml+xml, are exposed. Apps using the default HTML parser mode or that do not accept SVG input are less likely to be affected, but the sources do not confirm this.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000626,"input_tokens":3373,"output_tokens":577,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116802':14A,17A '-2026':13A,16A '3.4.17':27B,78C 'allow':87C 'anim':32B,116C 'app':24B 'application/xhtml':45B,101C 'attack':54B,88C,110C 'attribut':3A,48B,108C 'attributenam':93C,121C 'block':30B 'bypass':5A,90C 'case':4A 'click':11A,72B,134C 'contain':79C 'cross':82C 'cross-sit':81C 'cve':12A,15A 'dompurifi':1A,18B,25B,76C 'element':35B,119C 'entri':126C 'execut':130C 'fail':28B 'frontend':19B 'guard':95C 'href':38B,94C,122C 'javascript':20B,58B,125C 'let':6A 'link':75B,137C 'lowercas':52B,107C 'media':42B,98C 'name':49B,109C 'packag':21B 'page':68B 'parser':41B,97C 'run':8A,64B 'sanit':74B,136C 'script':9A,65B,84C,131C 'set':34B,118C 'site':83C 'smil':2A,61B,92C 'submit':112C 'suppli':56B 'svg':7A,31B,113C 'target':37B 'transformcasefunc':104C 'type':43B,99C 'url':59B 'use':120C 'user':71B,133C 'valu':62B,128C 'vulner':85C 'web':23B 'web-app':22B 'xml':46B,102C","nicknames":[],"mitigations":[],"who_affected":"Applications that use DOMPurify before 3.4.17 to sanitize user-supplied SVG or HTML, and that set the parser media type to application/xhtml+xml, are exposed. Apps using the default HTML parser mode or that do not accept SVG input are less likely to be affected, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116802","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116802","severity":null,"published_at":"2026-10-27T00:17:11+00:00","modified_at":"2026-10-27T00:17:11+00:00","first_seen_at":"2026-10-27T00:25:55+00:00","fetched_at":"2026-10-27T00:25:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}