diff --git a/web/package.json b/web/package.json
index 41273661ce2..517db3a442d 100644
--- a/web/package.json
+++ b/web/package.json
@@ -132,7 +132,7 @@
       "colord": "2.9.4",
       "markdown-it": "14.3.3",
       "esbuild": "0.28.1",
-      "dompurify": "3.4.16",
+      "dompurify": "3.4.17",
       "qs": "6.16.0"
     },
     "patchedDependencies": {
diff --git a/web/packages/web-app-files/package.json b/web/packages/web-app-files/package.json
index 6dafe72c3d7..65c75a4ccf6 100644
--- a/web/packages/web-app-files/package.json
+++ b/web/packages/web-app-files/package.json
@@ -16,7 +16,7 @@
     "@ownclouders/web-pkg": "workspace:*",
     "@uppy/core": "5.2.0",
     "@vueuse/core": "^11.0.0 || ^12.0.0 || ^13.0.0 || ^14.0.0",
-    "dompurify": "^3.4.2",
+    "dompurify": "^3.4.17",
     "email-validator": "^2.0.4",
     "fuse.js": "7.3.0",
     "lodash-es": "4.18.1",
diff --git a/web/packages/web-app-mermaid-editor/package.json b/web/packages/web-app-mermaid-editor/package.json
index 87cae7af1f8..c25a18bf66c 100644
--- a/web/packages/web-app-mermaid-editor/package.json
+++ b/web/packages/web-app-mermaid-editor/package.json
@@ -12,7 +12,7 @@
     "@codemirror/language": "^6.11.3",
     "@codemirror/state": "^6.5.2",
     "@codemirror/view": "^6.38.2",
-    "dompurify": "^3.4.16",
+    "dompurify": "^3.4.17",
     "mermaid": "^11.12.2"
   },
   "devDependencies": {
diff --git a/web/packages/web-pkg/package.json b/web/packages/web-pkg/package.json
index d2744b76b85..07195a36e08 100644
--- a/web/packages/web-pkg/package.json
+++ b/web/packages/web-pkg/package.json
@@ -58,7 +58,7 @@
     "@vue/shared": "^3.5.43",
     "@vueuse/core": "^14.3.0",
     "deepmerge": "^4.3.1",
-    "dompurify": "^3.4.13",
+    "dompurify": "^3.4.17",
     "emoji-regex": "^10.6.0",
     "filesize": "^11.0.17",
     "fuse.js": "^7.3.0",
diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml
index 3a6a9ffa30f..e9708e6905a 100644
--- a/web/pnpm-lock.yaml
+++ b/web/pnpm-lock.yaml
@@ -31,7 +31,7 @@ overrides:
   colord: 2.9.4
   markdown-it: 14.3.3
   esbuild: 0.28.1
-  dompurify: 3.4.16
+  dompurify: 3.4.17
   qs: 6.16.0
 
 patchedDependencies:
@@ -669,8 +669,8 @@ importers:
         specifier: ^11.0.0 || ^12.0.0 || ^13.0.0 || ^14.0.0
         version: 14.3.0(vue@3.5.43(typescript@5.9.3))
       dompurify:
-        specifier: 3.4.16
-        version: 3.4.16
+        specifier: 3.4.17
+        version: 3.4.17
       email-validator:
         specifier: ^2.0.4
         version: 2.0.4
@@ -767,8 +767,8 @@ importers:
         specifier: workspace:*
         version: link:../web-pkg
       dompurify:
-        specifier: 3.4.16
-        version: 3.4.16
+        specifier: 3.4.17
+        version: 3.4.17
       mermaid:
         specifier: ^11.12.2
         version: 11.16.1
@@ -1058,8 +1058,8 @@ importers:
         specifier: ^4.3.1
         version: 4.3.1
       dompurify:
-        specifier: 3.4.16
-        version: 3.4.16
+        specifier: 3.4.17
+        version: 3.4.17
       emoji-regex:
         specifier: ^10.6.0
         version: 10.6.0
@@ -1213,8 +1213,8 @@ importers:
         specifier: 4.3.1
         version: 4.3.1
       dompurify:
-        specifier: 3.4.16
-        version: 3.4.16
+        specifier: 3.4.17
+        version: 3.4.17
       email-validator:
         specifier: 2.0.4
         version: 2.0.4
@@ -4746,8 +4746,8 @@ packages:
     resolution: {integrity: sha512-IGBwjF7tNk3cwypFNH/7bfzBcgSCbaMOD3GsaY1AU/JRrnHnYgEM0+9kQt52iZxjNsjBtJYtao146V+f8jFZNw==}
     engines: {node: '>=10'}
 
-  dompurify@3.4.16:
-    resolution: {integrity: sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ==}
+  dompurify@3.4.17:
+    resolution: {integrity: sha512-B/pSlYVHQ58kqISD/yDjuJ1yfzI34m1gF4lAod2bwSRhiN4K5Cl3H8Af7hqB2PmTL911tdEudnnXn5FnhRoz0w==}
 
   dotenv-expand@12.0.3:
     resolution: {integrity: sha512-uc47g4b+4k/M/SeaW1y4OApx+mtLWl92l5LMPP0GNXctZqELk+YGgOPIIC5elYmUH4OuoK3JLhuRUYegeySiFA==}
@@ -12080,7 +12080,7 @@ snapshots:
 
   domain-browser@4.22.0: {}
 
-  dompurify@3.4.16:
+  dompurify@3.4.17:
     optionalDependencies:
       '@types/trusted-types': 2.0.7
 
@@ -13494,7 +13494,7 @@ snapshots:
       d3-sankey: 0.12.3
       dagre-d3-es: 7.0.14
       dayjs: 1.11.21
-      dompurify: 3.4.16
+      dompurify: 3.4.17
       es-toolkit: 1.49.0
       katex: 0.16.47
       khroma: 2.1.0