{"id":"EUVD-2026-110510","enisaUuid":"3890faee-a54f-3f2d-903f-991fc02036fb","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName\u003dhref guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName\u003d\"href\" and a javascript: entry in values to execute script when users click the sanitized link.","datePublished":"Oct 26, 2026, 11:05:34 PM","dateUpdated":"Oct 26, 2026, 11:05:34 PM","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-c6gr-qvv4-5v3f\nhttps://www.vulncheck.com/advisories/dompurify-before-3.4.17-xss-via-smil-attributename-guard-bypass-in-xhtml-mode\n","aliases":"CVE-2026-116802\nGHSA-g32m-chc6-3wqf\n","assigner":"VulnCheck","epss":0.0,"enisaIdProduct":[{"id":"fb78b7d9-6aba-356b-a062-af9e70872b48","product":{"name":"DOMPurify","vendor":{"name":"cure53"}},"product_version":"0 \u003c3.4.17"}],"enisaIdVendor":[{"id":"fca68ff4-af09-374b-b913-3eb03f8f6223","vendor":{"name":"cure53"}}],"enisaIdVulnerability":[{"id":"9fed3129-8e04-3d28-bbac-d1b578a1c049","vulnerability":{"id":"CVE-2026-116802","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName\u003dhref guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName\u003d\"href\" and a javascript: entry in values to execute script when users click the sanitized link.","datePublished":"Oct 26, 2026, 11:05:34 PM","dateUpdated":"Oct 26, 2026, 11:05:34 PM","status":"PUBLISHED","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-c6gr-qvv4-5v3f\nhttps://www.vulncheck.com/advisories/dompurify-before-3.4.17-xss-via-smil-attributename-guard-bypass-in-xhtml-mode\n","enisa_id":"EUVD-2026-110510\n","assigner":"VulnCheck","epss":0.0,"dataProcessed":"Oct 28, 2026, 2:00:25 AM","vulnerabilityProduct":[{"id":"ef4a8e37-35c4-34d9-9f35-977ce4ddb99c","product":{"name":"DOMPurify","vendor":{"name":"cure53"}},"product_version":"0 \u003c3.4.17"}],"vulnerabilityVendor":[{"id":"beef4468-8bf1-3d84-af72-eb3de4568b22","vendor":{"name":"cure53"}}]}},{"id":"a92ee43d-4017-354b-a1b5-1cf3e4a5b356","vulnerability":{"id":"GHSA-g32m-chc6-3wqf","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName\u003dhref guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName\u003d\"href\" and a javascript: entry in values to execute script when users click the sanitized link.","datePublished":"Oct 27, 2026, 12:32:50 AM","dateUpdated":"Oct 27, 2026, 12:32:50 AM","baseScore":0.0,"references":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-c6gr-qvv4-5v3f\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116802\nhttps://www.vulncheck.com/advisories/dompurify-before-3.4.17-xss-via-smil-attributename-guard-bypass-in-xhtml-mode\n","enisa_id":"EUVD-2026-110510\n","aliases":"CVE-2026-116802\nGHSA-g32m-chc6-3wqf\n","epss":0.0,"dataProcessed":"Oct 28, 2026, 2:02:34 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}