DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

影響: npm:dompurify <= 3.4.16 → 3.4.17

DOMPurify drops attributeName attributes whose value contains href, so an allowed or can't rewrite a link's href after sanitizing. The check compares the attribute name after transformCaseFunc, and that function doesn't lowercase in XHTML mode. In XHTML the attribute is spelled attributeName, so the comparison with "attributename" never matches and the guard does nothing. An app that uses PARSER_MEDIA_TYPE: 'application/xhtml+xml' and allows animate and attributeName will keep . Clicking the pa…

Read on GitHub Advisory Database

On 10/23/2026, 01:24 AM, GitHub Advisory Database published "DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml" (type: Advisory). Severity is "Low" (low). Related technologies: JavaScript / Node.js.