GHSA-c6gr-qvv4-5v3f: DOMPurify XHTML-mode SVG sanitization allows click-triggered XSS
Summary
GHSA-c6gr-qvv4-5v3f: A crafted SVG can execute script in the application’s origin when a user clicks a sanitized link under a specific XHTML configuration. Affects dompurify versions < 3.4.17. Fixed in 3.4.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DOMPurify is an HTML sanitization package in the npm ecosystem. It sanitizes markup before applications insert it into a page, helping prevent unsafe content from executing. Developers use it to process user-provided HTML and SVG, with parser settings and allowlists that control which markup and attributes remain in the sanitized output.
Vulnerability Detail
This flaw can cause click-triggered cross-site scripting in applications that sanitize SVG using XHTML mode and allow specific animation tags and attributes. In application/xhtml+xml mode, the case-sensitive attributeName spelling bypasses a guard intended to remove attributes that can rewrite an SVG link’s href. An attacker can use an allowed animation to change a parent link to a script URL; clicking the link runs script in the application’s origin. Default configurations and text/html mode are not affected.
How To Fix
Latest published version: 3.4.17 as of 22 Oct 2026
npm install dompurify@3.4.17The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
AI-generated workaround (not vendor-documented): Until upgrading dompurify, disable XHTML parsing for untrusted SVG or remove animation tags and attributeName from the allowlist. If XHTML mode is required, reject those elements and attributes before sanitization.
Documented mitigation:
<animate attributeName=\"href\" values=\"x;javascript:alert(1)\">
Conclusion
Bottom line: upgrade dompurify to 3.4.17. The issue requires a non-default XHTML configuration that allows SVG animation elements and attributeName; default configurations and text/html mode are not affected. Review applications that sanitize SVG in XHTML mode and remove the relevant allowlist entries until the upgrade is applied. Vulert monitors the dependencies in package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for dompurify →
FAQ
dompurify versions through 3.4.16 are affected; the published affected range begins at version 0.
An attacker can trigger script execution in the application’s origin when a user clicks a crafted sanitized SVG link under the affected configuration.
Upgrade dompurify to the minimum fixed version, 3.4.17.
Disable XHTML parsing for untrusted SVG or remove animation tags and attributeName from dompurify’s allowlist until upgrading.
Check package-lock.json for dompurify. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for dompurify.
