CVE-2026-116802 in DOMPurify
Summary
by MITRE • 10/27/2026
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName="href" and a javascript: entry in values to execute script when users click the sanitized link.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in DOMPurify prior to version 3.4.17 represents a critical failure in input sanitization logic, specifically within the context of XML parsing modes. DOMPurify is widely adopted as a robust library for cleaning HTML and SVG content to prevent cross-site scripting attacks. However, when configured with PARSER_MEDIA_TYPE set to application/xhtml+xml, the sanitizer relies on specific transformation functions to normalize attribute names before validation. The core technical flaw lies in the transformCaseFunc implementation, which fails to lowercase attribute names during this normalization phase. This oversight creates a bypass mechanism for security guards that are designed to block dangerous attributes, particularly those related to hyperlinks and animations within SVG elements.
In standard HTML parsing modes, DOMPurify typically normalizes all attribute names to lowercase before checking them against its allowlist or denylist. This ensures that variations in casing cannot be used to evade filters. However, the XML parser path did not enforce this lowercasing consistently for certain attributes. An attacker can exploit this by crafting a malicious SVG payload containing animate or set elements where the attributeName is specified as href with mixed case or uppercase characters. Because the sanitizer does not normalize these names before applying security rules, it fails to recognize that the attribute is effectively an href link. Consequently, the guard intended to prevent javascript: URIs in hyperlink attributes remains inactive for this specific input format.
The operational impact of this vulnerability allows remote attackers to execute arbitrary JavaScript code within the context of a victim's browser session. By embedding a malicious SVG object or inline SVG into a web page that uses DOMPurify with XML parsing enabled, an attacker can inject script payloads via javascript: URIs in animation values. When a user interacts with the sanitized content by clicking on the affected link element, the browser interprets the javascript: protocol and executes the embedded code. This constitutes a classic stored or reflected cross-site scripting attack vector, depending on how the payload is delivered to the victim. The severity is heightened because it bypasses one of the primary defenses against SVG-based XSS attacks that have been prevalent in web security for years.
This flaw aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. It also maps to MITRE ATT&CK technique T1059.007, JavaScript Execution, specifically within the context of client-side code injection via web browsers. The vulnerability highlights the importance of consistent normalization logic across different parsing modes in security libraries. Developers relying on DOMPurify for XML content must ensure they are using version 3.4.17 or later to mitigate this risk. Additionally, defense-in-depth strategies such as Content Security Policy should be implemented to restrict script execution sources and further reduce the impact of any potential bypasses that may exist in third-party sanitization libraries.