ghsa:GHSA-C6GR-QVV4-5V3F: dompurify <= 3.4.16

DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml. Affected range: <= 3.4.16. Fixed version: 3.4.17.

Affected technology

dompurify · <= 3.4.16
Vendor not specified by the source

Component: Not specified by the source
Function: doesn, for

What an attacker can do

The source does not specify what an attacker can achieve.

Published 22-Oct-2026 20:58 UTC

Product: dompurify
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-22 20:55:42.144132+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-c6gr-qvv4-5v3f.html