npm/dompurify: low

DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

Action: Upgrade dompurify to 3.4.17 or later.

npm i dompurify@3.4.17

Affected

Fixed versions

Sources

• osv: GHSA-c6gr-qvv4-5v3f
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-c6gr-qvv4-5v3f
• https://github.com/cure53/DOMPurify/pull/1672
• https://github.com/cure53/DOMPurify/commit/a77a3e78b59f72fa4d1c83f22e121ad9cc7d3575
• https://github.com/cure53/DOMPurify
• https://github.com/cure53/DOMPurify/releases/tag/3.4.17

published 2026-10-22T16:24:23Z · modified 2026-10-22T16:30:30.125885064Z · JSON