CVE-2026-84371: Stored XSS via SVG SMIL URI-list Scheme-Policy Bypass in sanitize-html

The library sanitize-html is designed to parse and clean untrusted HTML input, neutralizing script execution vectors while allowing safe tags and attributes to persist. In applications handling user-generated content, rich-text features often allow a subset of SVG tags to enable vector illustrations or animated graphics.

SVG Synchronized Multimedia Integration Language (SMIL) elements, such as <animate> or <set>, present a unique challenge to static sanitizers. These elements allow dynamic manipulation of DOM attributes of parent or sibling tags directly inside the browser's XML rendering engine.

When sanitize-html is configured to allow certain SVG animation elements, it exposes an attack surface where client-side state transitions can alter attributes after sanitization. By abusing this dynamic state transition, attackers can craft payloads that bypass standard URI scheme policies.

The underlying vulnerability arises from how the sanitization library evaluates complex attribute values compared to how web browsers render them at runtime.

Standard HTML attributes like href hold a single URL value, which the sanitizer evaluates as a flat string. If sanitize-html encounters an anchor or SVG link attribute, it checks whether the URI scheme starts with a safe scheme such as http, https, or # (relative fragment).

In the SVG SMIL specification, elements use the values attribute to specify a transition path. When the attributeName of an <animate> tag is set to href, the values attribute takes a semicolon-separated list of target URIs (e.g., values="#safe;javascript:alert(1)").

During sanitization, the parser evaluates the entire values string as a single, flat URL structure. Since the string begins with the allowed fragment character #, the library's scheme validator rules it safe and retains the attribute. Upon browser rendering, the client engine splits the semicolon-separated list and eventually executes the dynamic write of the subsequent javascript: URI into the host element's live href sink, bypassing the sanitization layer completely.

To understand the implementation flaw, we examine the behavioral difference between the vulnerable code path and the patched implementation.

In vulnerable versions of the library, attributes such as values were evaluated on a per-attribute level based on basic regex or scheme matching logic. The library lacked the context that the value in the values attribute would eventually be written to a target URL sink defined by attributeName.

In the patched version (2.17.7), the maintainers introduced the animatesUrlAttribute helper function. This helper intercepts incoming SVG SMIL elements (animate, animatecolor, animatemotion, animatetransform, set) and inspects their target configuration:

function animatesUrlAttribute(name, attribs) {
  if (svgAnimationTags.indexOf(name.toLowerCase()) === -1) {
    return false;
  }
  const schemeCheckedAttributes = options.allowedSchemesAppliedToAttributes || [];
  return Object.keys(attribs || {}).some(function(attributeName) {
    if (attributeName.toLowerCase() !== 'attributename') {
      return false;
    }
    const target = (attribs[attributeName] || '').trim().toLowerCase();
    const localName = target.slice(target.lastIndexOf(':') + 1);
    return alwaysUrlAttributes.indexOf(localName) !== -1 ||
      schemeCheckedAttributes.indexOf(target) !== -1 ||
      schemeCheckedAttributes.indexOf(localName) !== -1;
  });
}

If the parser detects that an animation element is targeting a URL-bearing attribute (like href or a custom configured scheme attribute), the validator immediately discards the entire element rather than trying to sanitize the complex value lists.

Exploitation of this vulnerability requires that the target application has enabled SVG and SMIL animation tags in its configuration. When these conditions are met, the attack can be executed using a stored XSS vector.

An attacker crafts a payload where an anchor element wraps a SMIL animation. The animation element targets the href attribute and passes a semicolon-separated list where the initial entry matches a benign destination, while the second entry contains the malicious payload:

<svg>
  <a>
    <animate attributeName="href" values="#safe;javascript:alert(document.domain)" dur=".01s" fill="freeze"></animate>
    <text y="30">Click to trigger action</text>
  </a>
</svg>

When the browser parses this structure, the SMIL engine triggers the animation. Because dur is set to .01s and fill is set to freeze, the parent anchor tag's href attribute is permanently rewritten to javascript:alert(document.domain) almost instantly. Clicking the text triggers the script immediately in the victim's session context.

The impact of this vulnerability depends heavily on the execution environment and context of the web application. Stored XSS typically allows attackers to execute arbitrary JavaScript in the context of authenticated sessions of other users.

In web portals, CMS platforms, or message boards where high-privilege users (such as administrators or content managers) interact with content, this flaw could allow an attacker to hijack active sessions, extract sensitive access tokens, or perform actions on behalf of other users.

The vulnerability is classified under CWE-79 (Cross-site Scripting). While the CVSS score is assigned as 5.4, the impact is bound by the fact that the application must explicitly allow SVG elements in its configuration, limiting the exploitability on default out-of-the-box configurations.

The primary remediation for this vulnerability is to upgrade the sanitize-html library to version 2.17.7 or higher, which handles SMIL animation components safely.

For applications that are unable to apply the package upgrade immediately, several defense-in-depth measures can be deployed to block this vector. The most effective mitigation is to review the allowedTags parameter in your sanitize-html configuration and ensure that SMIL tags like animate, animatecolor, animatemotion, animatetransform, and set are excluded from the allowed list.

Additionally, implementing a strict Content Security Policy (CSP) that restricts inline script execution (script-src 'self') will block the execution of the injected javascript: URI even if it successfully bypasses the sanitization parser.