DOMPurify CVE-2026-116802

Exploitation requires a specific non-default DOMPurify configuration: the integrating application must set PARSER_MEDIA_TYPE to 'application/xhtml+xml' AND allow the SVG animate (or set) element together with the attributeName attribute - e.g. ALLOWED_TAGS/ALLOWED_ATTR including 'animate' and 'attributeName', or USE_PROFILES:{svg:true} with ADD_TAGS:['animate'] and ADD_ATTR:['attributeName']. In XHTML mode transformCaseFunc is the identity function, so the case-sensitive XML name 'attributeName' never matches the lowercase 'attributename' guard and the href-stripping check is bypassed. Limiting factors: text/html (default) parser mode is not affected because the name is lowercased and stripped; the required camelCase allow-listing is non-default; and successful script execution needs user interaction (the victim must click the parent link whose href is rewritten to the javascript: value via SMIL fill="freeze"). The vendor notes updating is the fix and treats this as a hardening bug for non-default configs.

Signals point to a real but low-to-moderate priority issue rather than an urgent one. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, score 5.1) shows a network-reachable, unauthenticated flaw with low complexity, but impact is confined to the subsequent system (the victim's browser) at low confidentiality/integrity and requires active user interaction - the victim must click the sanitized link. EPSS is low at 0.22% (12th percentile), the CVE is not listed in CISA KEV, and the vuln.today decision label is 'this_month' rather than act_now/emergency, all consistent with limited, non-urgent risk. A detailed, reporter-tested PoC is included in the GHSA advisory, which raises practical exploitability above what the low EPSS alone implies, but exploitation is gated on a non-default configuration (see exploitation_conditions) that the vendor itself classifies as a hardening bug, not a default-config bypass. Net: a genuine XSS worth patching on a normal cycle, not a drop-everything emergency; the main uplift in risk comes from the published PoC and the ease of the SMIL/javascript: technique, while the non-default XHTML config requirement and the required click sharply limit the exposed population.

An application that runs DOMPurify in XHTML parser mode and allow-lists the SVG animate element plus the attributeName attribute accepts attacker-supplied markup. The attacker submits an SVG containing <a><animate attributeName="href" values="x;javascript:alert(1)" fill="freeze"/></a>; because the attributeName href guard is skipped in XHTML mode, the payload survives sanitization and is rendered to another user, who executes script in their browser by clicking the link. A reporter-tested proof-of-concept demonstrating this against DOMPurify 3.4.16 in Chrome is published in the GHSA advisory.