Vulnerabilities

Vulnerability · GHSA-c6gr-qvv4-5v3f

DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

Published Oct 22, 2026 · catalog updated Oct 22, 2026 · DOMPurify: SMIL attributeName=href guard

Last checked Oct 23, 2026, 15 days ago.

Open the advisory

Exploitation likelihood is not on this record for GHSA-c6gr-qvv4-5v3f. A missing EPSS score is not a low risk. Compare DOMPurify: SMIL attributeName=href guard with the linked advisory before you change production.

Severity

Low—

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Version ranges on file

Affected products

npm dompurify

### Summary DOMPurify drops attributes whose value contains , so an allowed or can't rewrite a link's href after sanitizing. The check compares the attribute name after , and that function doesn't lowercase in XHTML mode. In XHTML the attribute is spelled , so the comparison with never matches and the guard does nothing. An app that uses and allows and will keep . Clicking the parent link then runs the script. This needs a non-default config, so going by SECURITY.md, this is a hardening bug rather than a bypass of the default config. ### Details In (dist/purify.js line 2216 in 3.4.16): is for text/html but the identity function for application/xhtml+xml, because XML names are case-sensitive. The XML parser keeps SVG's real name , so in XHTML mode is and the branch never runs. People using XHTML mode have to list SVG attributes in camelCase. The built-in attribute lists are lowercase and won't match, so / is the config you'd naturally write here. The value also passes the URI check. only checks the start of the string, and looks like a relative value. SMIL reads as a list and, with , the last entry ends up as the effective href of the parent . In text/html mode the same allowlist is handled correctly. The name is lowercased and is removed. This is close to the XHTML case-sensitivity hardening in 3.4.14/3.4.15 (Attack Classes & Bypass History §22): a check written for lowercase names that a case-preserved name gets past. ### Proof of concept Tested with DOMPurify 3.4.16 in Chrome 153 (headless shell). Also reproduced on 3.3.3, 3.3.1 and 3.2.7. Not confirmed for 2.x. Config: behaves the same. Input: Steps: 1. Save this as next to (3.4.16) and open it in Chrome. The extension makes Chrome load it as application/xhtml+xml, so nothing moves between HTML and XHTML. 2. The logged output still contains and . 3. returns . 4. Click "click" and runs. As a control, remove and change the allowlist entry to . The output then loses , is , and clicking does nothing. The same XHTML-m