Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.1
DOMPurify may allow malicious script in SVG links
published 9 days ago
Summary
The DOMPurify library used to clean web content can be tricked when handling certain SVG files, letting a hidden script run when a user clicks a link. This happens because the library does not correctly process attribute names in a specific file type. Update DOMPurify to the latest version or apply the recommended patch to stop this behavior.
What to do
- Update cure53 dompurify to version 3.4.17.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | cure53 | dompurify |
< 3.4.17 Fix: upgrade to 3.4.17
|
Original advisory text
DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName="href" and a javascript: entry in values to execute script when users click the sanitized link.
References
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-c6gr-qvv4-5v3f URL
- https://github.com/cure53/DOMPurify/pull/1672 URL
- https://github.com/cure53/DOMPurify/commit/a77a3e78b59f72fa4d1c83f22e121ad9cc7d3... URL
- https://github.com/cure53/DOMPurify Product
- https://github.com/cure53/DOMPurify/releases/tag/3.4.17 URL
Severity
5.1
Medium
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published27 Oct 2026
Updated27 Oct 2026
First seen22 Oct 2026
Sources
GHSA-c6gr-qvv4-5v3f · OSV
Track software like this
Free during beta