{"id":"CVE-2026-116802","title":"DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode","summary":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribu…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"cure53","product":"DOMPurify","affected":["DOMPurify < 3.4.17"],"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T23:05:34.457Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116802","references":[{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-c6gr-qvv4-5v3f","label":"GitHub Security Advisory (GHSA-c6gr-qvv4-5v3f)"},{"url":"https://www.vulncheck.com/advisories/dompurify-before-3.4.17-xss-via-smil-attributename-guard-bypass-in-xhtml-mode","label":"VulnCheck Advisory: DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode"}],"tags":["cve.org"],"epss":0.00217,"epssPercentile":0.12072,"ingestedAt":"2026-10-27T16:11:59.139Z","slug":"CVE-2026-116802","body":"## Overview\n\nDOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName=\"href\" and a javascript: entry in values to execute script when users click the sanitized link.\n\n## Affected\n\n- `DOMPurify < 3.4.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}