Is CVE-2026-116802 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116802 being exploited in the wild.

How severe is CVE-2026-116802?

Medium severity, with a CVSS score of 6.1, published 27 October 2026.

Which products and versions are affected?

Cure53 DOMPurify before 3.4.17.

How is CVE-2026-116802 attacked?

It is attacked over the network.

Am I affected by CVE-2026-116802?

Check whether you run Cure53 DOMPurify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116802: DOMPurify cross-site scripting in SMIL attributeName guard bypass

CVE-2026-116802 · Severity: medium · CVSS 6.1 · Published 2026-10-27

DOMPurify is a widely used library that removes unsafe HTML and JavaScript from user-supplied content in web applications. When configured to use XHTML parsing mode (application/xhtml+xml), the library fails to properly sanitize SVG animate elements that specify an href target via SMIL attributes. An attacker can craft malicious SVG markup that, when clicked by a user, executes arbitrary JavaScript code in the victim's browser, potentially leading to account takeover or data theft.

Technologies: Cure53 DOMPurify. Vendors: Cure53.

Quick answers

Is CVE-2026-116802 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116802 being exploited in the wild.
How severe is CVE-2026-116802?: Medium severity, with a CVSS score of 6.1, published 27 October 2026.
Which products and versions are affected?: Cure53 DOMPurify before 3.4.17.
Is there a fix for CVE-2026-116802?: Yes: fixed in 3.4.17. Until then: Avoid setting PARSER_MEDIA_TYPE to application/xhtml+xml unless XHTML parsing is strictly required. When using XHTML mode, do not allow SVG animate or set elements in the ALLOWED_TAGS configuration, or do not list attributeName in ALLOWED_ATTR or ADD_ATTR. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116802 attacked?: It is attacked over the network.
Am I affected by CVE-2026-116802?: Check whether you run Cure53 DOMPurify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.4.17

Avoid setting PARSER_MEDIA_TYPE to application/xhtml+xml unless XHTML parsing is strictly required. When using XHTML mode, do not allow SVG animate or set elements in the ALLOWED_TAGS configuration, or do not list attributeName in ALLOWED_ATTR or ADD_ATTR.

Technical details

When DOMPurify is configured with PARSER_MEDIA_TYPE set to application/xhtml+xml, the transformCaseFunc function preserves attribute name case (as per XML specification) instead of lowercasing. The attributeName href guard in _sanitizeAttributes compares against the lowercase string "attributename", but in XHTML mode the attribute remains camelCase (attributeName), causing the comparison to fail. An attacker can then use SVG animate or set elements with attributeName="href" and values containing a javascript: URI to modify link targets, executing script upon user interaction.

Affected products

cure53 DOMPurify before 3.4.17

Timeline

2026-10-12: disclosed
2026-10-27: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.