## DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

- 種別: advisory
- 重大度: low
- 関連技術: nodejs
- 公開日時: 2026-10-22T16:24:23.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-c6gr-qvv4-5v3f)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-c6gr-qvv4-5v3f

影響: npm:dompurify <= 3.4.16 → 3.4.17
DOMPurify drops attributeName attributes whose value contains href, so an allowed or can't rewrite a link's href after sanitizing. The check compares the attribute name after transformCaseFunc, and that function doesn't lowercase in XHTML mode. In XHTML the attribute is spelled attributeName, so the comparison with "attributename" never matches and the guard does nothing. An app that uses PARSER_MEDIA_TYPE: 'application/xhtml+xml' and allows animate and attributeName will keep . Clicking the pa…