https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 29 Oct 2026 02:57:10 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-116802 <p>DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName=&#34;href&#34; and a javascript: entry in values to execute script when users click the sanitized link.</p> <p>DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName=&#34;href&#34; and a javascript: entry in values to execute script when users click the sanitized link.</p> https://db.gcve.eu/vuln/fkie_cve-2026-116802 https://db.gcve.eu/vuln/ghsa-g32m-chc6-3wqf <p>DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName=&#34;href&#34; and a javascript: entry in values to execute script when users click the sanitized link.</p> <p>DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName=&#34;href&#34; and a javascript: entry in values to execute script when users click the sanitized link.</p> https://db.gcve.eu/vuln/ghsa-g32m-chc6-3wqf https://db.gcve.eu/vuln/ubuntu-cve-2026-116802 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: node-dompurify, Ubuntu:24.04:LTS: node-dompurify, Ubuntu:26.10: node-dompurify, Ubuntu:26.04:LTS: node-dompurify</p> <p>DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName=&#34;href&#34; and a javascript: entry in values to execute script when users click the sanitized link.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: node-dompurify, Ubuntu:24.04:LTS: node-dompurify, Ubuntu:26.10: node-dompurify, Ubuntu:26.04:LTS: node-dompurify</p> <p>DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName=&#34;href&#34; and a javascript: entry in values to execute script when users click the sanitized link.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-116802