Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, published 22 October 2026.

Which products and versions are affected?

Cure53 DOMPurify <=3.4.16; dompurify (npm) <= 3.4.16, SEMVER:introduced=0,fixed=3.4.17.

Is there a fix for This vulnerability?

Yes. dompurify (npm): upgrade to 3.4.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Cure53 DOMPurify or dompurify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

DOMPurify SMIL attributeName=href guard bypass in XHTML mode

Q: Which products and versions are affected?

Cure53 DOMPurify <=3.4.16; dompurify (npm) <= 3.4.16, SEMVER:introduced=0,fixed=3.4.17.

Q: Is there a fix for This vulnerability?

Yes. dompurify (npm): upgrade to 3.4.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run Cure53 DOMPurify or dompurify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: low · Published 2026-10-22

DOMPurify is a library that sanitizes HTML and SVG content to prevent cross-site scripting attacks. When configured to parse XHTML documents and allow SVG animation elements, DOMPurify fails to block a dangerous attributeName="href" attribute that can inject malicious JavaScript. An attacker can craft an SVG that modifies a link's target to execute JavaScript when clicked.

Technologies: Cure53 DOMPurify, dompurify (npm). Vendors: Cure53, npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, published 22 October 2026.
Which products and versions are affected?: Cure53 DOMPurify <=3.4.16; dompurify (npm) <= 3.4.16, SEMVER:introduced=0,fixed=3.4.17.
Is there a fix for This vulnerability?: Yes. dompurify (npm): upgrade to 3.4.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Cure53 DOMPurify or dompurify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

dompurify (npm): upgrade to 3.4.17 or later
```
npm install dompurify@3.4.17
```

Technical details

The vulnerability is a case-sensitivity bypass in the attributeName=href guard when PARSER_MEDIA_TYPE is set to 'application/xhtml+xml'. In XHTML mode, the transformCaseFunc does not lowercase attribute names (preserving XML case-sensitivity), so the check comparing lcName === "attributename" fails when the actual attribute is "attributeName". This allows SMIL animate/set elements with attributeName="href" and malicious values to pass through; with fill="freeze", the semicolon-delimited values syntax causes the JavaScript URI to become the effective href of the parent link.

Affected products

cure53 DOMPurify <=3.4.16

Timeline

2026-10-22: disclosed
2026-10-12: advisory
2026-10-22: patched: fix in version 3.4.17

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.