Source: node-dompurify Version: 3.4.16+dfsg-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerabilities were published for node-dompurify. CVE-2026-116802[0]: | DOMPurify before 3.4.17 contains a cross-site scripting | vulnerability that allows attackers to bypass the SMIL | attributeName=href guard when PARSER_MEDIA_TYPE is | application/xhtml+xml, because transformCaseFunc does not lowercase | attribute names. Attackers can submit SVG with an animate or set | element using attributeName="href" and a javascript: entry in values | to execute script when users click the sanitized link. CVE-2026-116803[1]: | DOMPurify before 3.4.17 contains a cross-site scripting | vulnerability that allows attackers to keep event handlers armed | when an IN_PLACE hook removes a parent or sibling node. Attacker | markup in detached subtrees is never walked or neutralized, so | handlers like img onerror fire after sanitize() returns, causing DOM | XSS. CVE-2026-116804[2]: | DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES | bypass that lets attackers preserve template expressions in attached | shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE | modes. Attackers can split expressions across text nodes separated | by disallowed elements, which merge after removal and are evaluated | by downstream template engines for cross-site scripting. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-116802 https://www.cve.org/CVERecord?id=CVE-2026-116802 [1] https://security-tracker.debian.org/tracker/CVE-2026-116803 https://www.cve.org/CVERecord?id=CVE-2026-116803 [2] https://security-tracker.debian.org/tracker/CVE-2026-116804 https://www.cve.org/CVERecord?id=CVE-2026-116804 Regards, Salvatore -- Pkg-javascript-devel mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
