Read the docs
TI-2026-80967 Aliases CVE-2026-116802GHSA-g32m-chc6-3wqf

Cross-site scripting in DOMPurify via SMIL attributeName bypass

Priority MEDIUM 56CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-79.

Summary

DOMPurify before 3.4.17 contains a cross-site scripting flaw in its sanitizer. Because transformCaseFunc does not lowercase attribute names, the SMIL attributeName="href" guard can be bypassed when the parser media type is application/xhtml+xml. A remote attacker who supplies SVG to a user needs that user to click the sanitized link to run script.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName="href" and a javascript: entry in values to execute script when users click the sanitized link.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00217 12th percentileScored 2026-11-07
Fix Partial DOMPurify (cure53): 3.4.17Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cure53DOMPurifybefore 3.4.173.4.17Patch availableCNA
  • DOMPurify Vendorcure53 Affected before 3.4.17 Fixed in 3.4.17 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*——cure53
  • cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:* Versions — — ·cure53

Remediation

Upgrade DOMPurify to version 3.4.17. Red Hat lists Red Hat Hardened Images as affected, with no fix plan available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA DOMPurify (cure53) Fixed in 3.4.17

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    cure53 DOMPurify 3.4.17

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-80969 SAFE_FOR_TEMPLATES bypass in DOMPurify enables cross-site scriptingPriority MEDIUM 56
    • TI-2026-80968 DOM XSS in DOMPurify via IN_PLACE hook-detached subtreesPriority MEDIUM 56
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesAffectedNo fix yet
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-116802
  2. 2026-10-27 Affected versions changed · Red Hat
  3. 2026-10-27 CVSS score added · Red Hat
  4. 2026-10-27 Alias added: GHSA-g32m-chc6-3wqf
  5. 2026-11-05 CISA SSVC decision points changed
  6. 2026-11-05 Priority changed: LOW → MEDIUM

References

Advisory 1

  • TI-2026-34986 DOMPurify XSS via `selectedcontent` re-clone CVSS 3.1HIGH 8.2
  • TI-2025-30422 Path traversal in cure53 DOMPurify CVSS 3.1HIGH 7.5
  • TI-2026-29847 DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback CVSS 3.1MEDIUM 6.9
  • TI-2026-36811 DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content CVSS 4.0MEDIUM 6.3
  • TI-2026-36614 DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM CVSS 3.1MEDIUM 6.1
  • TI-2026-36613 DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks CVSS 3.1MEDIUM 6.1
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences