CVE-2026-84371: CVE-2026-84371: Stored XSS via SVG SMIL URI-list Scheme-Policy Bypass in sanitize-html

#security #cve #cybersecurity

CVE-2026-84371: Stored XSS via SVG SMIL URI-list Scheme-Policy Bypass in sanitize-html

Vulnerability ID: CVE-2026-84371
CVSS Score: 5.4
Published: 2026-09-01

A stored Cross-Site Scripting (XSS) vulnerability exists in sanitize-html from version 1.9.0 up to 2.17.6. The flaw permits attackers to bypass scheme-policy enforcement using SVG SMIL animation elements targeting URL attributes with semicolon-separated URI lists.

TL;DR

SVG SMIL animation tags allow bypass of sanitize-html's scheme filtering via semicolon-separated lists in 'values' attributes, leading to arbitrary JavaScript execution.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-79
Attack Vector: Network (AV:N)
CVSS Severity Score: 5.4 (Medium)
Exploit Status: poc
CISA KEV Status: Not Listed
Impact: Stored Cross-Site Scripting (XSS)

Affected Systems

sanitize-html
sanitize-html: >= 1.9.0, < 2.17.7 (Fixed in: 2.17.7)

Code Analysis

Commit: 1135516

Upstream Fix Commit (Branch Integration)

Commit: 38ff110

Upstream Fix Commit (Reconciliation & Release)

Exploit Details

GitHub Security Advisory: Official advisory with detailed explanation of SVG SMIL bypass

Mitigation Strategies

Upgrade sanitize-html to version 2.17.7 or higher
Remove SVG animation tags (animate, set) from allowedTags in sanitize-html configurations
Deploy Content Security Policy (CSP) headers that disable unsafe-inline javascript execution

Remediation Steps:

Identify all service dependencies and update package.json to require sanitize-html >= 2.17.7
Execute npm update sanitize-html or yarn upgrade sanitize-html
Verify sanitize-html instantiation calls across the codebase to ensure SVG SMIL animation tags are not explicitly enabled

References

Read the full report for CVE-2026-84371 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community