DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-116802 · Microsoft / collected KEV context

EUVD-2026-110510

GHSA-g32m-chc6-3wqf

GHSA-c6gr-qvv4-5v3f

cve-program · CVE-2026-116802

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-c6gr-qvv4-5v3f
• https://www.vulncheck.com/advisories/dompurify-before-3.4.17-xss-via-smil-attributename-guard-bypass-in-xhtml-mode

euvd · EUVD-2026-110510

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-c6gr-qvv4-5v3f
• https://www.vulncheck.com/advisories/dompurify-before-3.4.17-xss-via-smil-attributename-guard-bypass-in-xhtml-mode

nvd · CVE-2026-116802

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-c6gr-qvv4-5v3f
• https://www.vulncheck.com/advisories/dompurify-before-3.4.17-xss-via-smil-attributename-guard-bypass-in-xhtml-mode

osv · GHSA-c6gr-qvv4-5v3f

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-c6gr-qvv4-5v3f
• https://github.com/cure53/DOMPurify/pull/1672
• https://github.com/cure53/DOMPurify/commit/a77a3e78b59f72fa4d1c83f22e121ad9cc7d3575
• https://github.com/cure53/DOMPurify
• https://github.com/cure53/DOMPurify/releases/tag/3.4.17

• DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute … · Advisory content revised · 29 Oct 2026
• DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode · Newly collected advisory · 27 Oct 2026
• DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml · Advisory content revised · 27 Oct 2026