DOMPurify versions before 3.4.17 contain a cross-site scripting flaw: the safeguard against SMIL's attributeName=href trick can be skipped once content is parsed as application/xhtml+xml, because a case-normalization step fails to lowercase attribute names. A proof-of-concept shows an SVG animate or set tag can point its attributeName at href with a javascript: payload as the value, so the script executes once someone interacts with the sanitized markup. The issue is fixed in DOMPurify 3.4.17.
// source: nvd.nist.gov ↗