Bug 2561481 (CVE-2026-116802)
| Summary: | CVE-2026-116802 dompurify: DOMPurify: Cross-site scripting via attribute sanitization bypass in XHTML mode | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in DOMPurify. This vulnerability allows a remote attacker to perform cross-site scripting (XSS). When configured to parse Extensible Hypertext Markup Language (XHTML) content, the library fails to properly normalize and sanitize attribute names within animation elements. An attacker could exploit this by submitting crafted Scalable Vector Graphics (SVG) content, which bypasses link filtering and executes malicious scripts in the victim's browser when clicked.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-10-26 23:22:24 UTC
|