UBUNTU-CVE-2026-116802: Medium severity ubuntu/node-dompurify vulnerability

Published Oct 27, 2026

Updated

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName="href" and a javascript: entry in values to execute script when users click the sanitized link.

Affected Software

4 affected components

ubuntu/node-dompurify*

Event History

Oct 27, 2026

CVE Published

via OSV·12:17 AM

Data Sourced

via OSV·12:17 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Under what conditions is an application exposed to this issue?

The application must use a DOMPurify version before 3.4.17, sanitize attacker-controlled SVG content with PARSER_MEDIA_TYPE set to application/xhtml+xml, and render the sanitized result where a user can click the crafted link.

What does an attacker need to provide to exploit the vulnerability?

An attacker needs to submit SVG containing an animate or set element with attributeName="href" and a javascript: payload in its values attribute. Exploitation also requires user interaction: the victim must click the sanitized link.

Does the vulnerability affect DOMPurify's default parsing configuration?

The described bypass specifically requires PARSER_MEDIA_TYPE to be application/xhtml+xml. The provided information does not indicate that the default parser configuration is affected.

UBUNTU-CVE-2026-116802: Medium severity ubuntu/node-dompurify vulnerability

Affected Software

Event History

Frequently Asked Questions

Under what conditions is an application exposed to this issue?

What does an attacker need to provide to exploit the vulnerability?

Does the vulnerability affect DOMPurify's default parsing configuration?

Company

Resources

Contact

Frequently Asked Questions

Under what conditions is an application exposed to this issue?

What does an attacker need to provide to exploit the vulnerability?

Does the vulnerability affect DOMPurify's default parsing configuration?