VDB
GHSA-c6gr-qvv4-5v3f
GHSA-c6gr-qvv4-5v3f
PUBLISHED
DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | nextcloud-server-35 | 0 |
| chainguard | nextcloud-server-34 | 0 |
| npm | dompurify | 0 |
| chainguard | opensearch-dashboards-2 | 0 |
| chainguard | opensearch-dashboards-2-fips | 0 |
Timeline
- Oct 22, 2026 CVE Published
References
- https://github.com/advisories/GHSA-c6gr-qvv4-5v3f advisory
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-c6gr-qvv4-5v3f url
- https://github.com/cure53/DOMPurify/pull/1672 patch
- https://github.com/cure53/DOMPurify/commit/a77a3e78b59f72fa4d1c83f22e121ad9cc7d3575 patch
- https://github.com/cure53/DOMPurify/releases/tag/3.4.17 url