CVE-2026-116802: DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode

Q: Which deployments are exposed to this issue?

Deployments using DOMPurify versions before 3.4.17 are affected when sanitization is performed with PARSER_MEDIA_TYPE set to application/xhtml+xml. The bypass specifically involves SVG content processed in XHTML mode.

Q: What must an attacker provide for exploitation to succeed?

An attacker must be able to submit SVG content that reaches DOMPurify for sanitization. The payload uses an animate or set element with attributeName="href" and a javascript: value in values; script execution occurs when a user clicks the sanitized link.

Q: Is user interaction required?

Yes. The supplied vector executes script when a user clicks the sanitized link.

Q: What can be done if upgrading is not immediately possible?

Avoid processing untrusted content with PARSER_MEDIA_TYPE set to application/xhtml+xml, and prevent untrusted SVG content containing animate or set elements from reaching the sanitizer in that mode.

Published Oct 26, 2026

Updated

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName="href" and a javascript: entry in values to execute script when users click the sanitized link.

Affected Software

1 affected component

Cure53 DOMPurify<3.4.17

Event History

Oct 26, 2026

CVE Published

via MITRE·11:05 PM

Data Sourced

via MITRE·11:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using DOMPurify versions before 3.4.17 are affected when sanitization is performed with PARSER_MEDIA_TYPE set to application/xhtml+xml. The bypass specifically involves SVG content processed in XHTML mode.

What must an attacker provide for exploitation to succeed?

An attacker must be able to submit SVG content that reaches DOMPurify for sanitization. The payload uses an animate or set element with attributeName="href" and a javascript: value in values; script execution occurs when a user clicks the sanitized link.

Is user interaction required?

Yes. The supplied vector executes script when a user clicks the sanitized link.

What can be done if upgrading is not immediately possible?

Avoid processing untrusted content with PARSER_MEDIA_TYPE set to application/xhtml+xml, and prevent untrusted SVG content containing animate or set elements from reaching the sanitizer in that mode.

CVE-2026-116802: DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide for exploitation to succeed?

Is user interaction required?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide for exploitation to succeed?

Is user interaction required?

What can be done if upgrading is not immediately possible?