{"action":"Upgrade dompurify to 3.4.17 or later.","affected":[{"fixed":"3.4.17","introduced":"0"}],"component":"dompurify","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["3.4.17"],"ghsa_id":"GHSA-c6gr-qvv4-5v3f","id":"tcs_01M5JMCSN1WDRBN8W61GGP5SKX","modified_at":"2026-10-22T16:30:30.125885064Z","published_at":"2026-10-22T16:24:23Z","references":["https://osv.dev/vulnerability/GHSA-c6gr-qvv4-5v3f","https://github.com/cure53/DOMPurify/security/advisories/GHSA-c6gr-qvv4-5v3f","https://github.com/cure53/DOMPurify/pull/1672","https://github.com/cure53/DOMPurify/commit/a77a3e78b59f72fa4d1c83f22e121ad9cc7d3575","https://github.com/cure53/DOMPurify","https://github.com/cure53/DOMPurify/releases/tag/3.4.17"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-c6gr-qvv4-5v3f","url":"https://osv.dev/vulnerability/GHSA-c6gr-qvv4-5v3f"}],"summary":"DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml"}