The vulnerability exists in DOMPurify versions prior to 3.4.17 and is a cross‑site scripting flaw that permits attackers to bypass the SMIL attributeName=href guard when the parser media type is application/xhtml+xml. A malicious craft can embed an SVG that contains an animate or set element with attributeName="href" pointing to a javascript: URL. When a user clicks the sanitized link, the browser executes the script, allowing the attacker to run arbitrary code in the context of the affected site.

This flaw affects all installations of DOMPurify from the cure53 vendor that use a version earlier than 3.4.17. There is no further version granularity provided; any pre‑3.4.17 build is potentially vulnerable.

The CVSS score of 5.1 indicates a moderate impact. While the EPSS score is not available, the issue is not listed in the CISA KEV catalog, suggesting limited public exploitation. The attack requires that the application processes user supplied SVG via DOMPurify in XHTML mode, meaning an attacker can achieve XSS by submitting crafted SVG content that bypasses the attribute guard. The resulting script execution can lead to theft of session data, defacement, or further lateral movement, depending on the context in which sanitized content is rendered.