Skip to main content

DOMPurify EUVDEUVD-2026-48277

| CVE-2026-65914 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-07-23 VulnCheck
XSS Dompurify Suse Red Hat
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.1 MEDIUM

Network-reachable with no auth required, but user interaction and scope change apply as JavaScript executes in victim browser context with no server-side impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
SUSE
6.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Red Hat
5.4 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

4
Patch available
Jul 23, 2026 - 15:18 EUVD
Source Code Evidence Fetched
Jul 23, 2026 - 13:51 vuln.today
Analysis Generated
Jul 23, 2026 - 13:51 vuln.today
CVE Published
Jul 23, 2026 - 13:16 cve.org
MEDIUM 5.3

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 287 npm packages depend on dompurify (25 direct, 262 indirect)

Ecosystem-wide dependent count for version 3.3.2.

DescriptionCVE.org

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper context during reparsing, reactivating dangerous markup with event handlers to execute JavaScript.

AnalysisAI

Mutation-XSS in DOMPurify before 3.3.2 enables JavaScript execution in victim browsers when sanitized output is re-inserted into the DOM via innerHTML using wrapper elements such as xmp, noscript, iframe, noembed, noframes, or script. Attacker-controlled payloads containing wrapper-closing sequences (e.g., </xmp>) survive DOMPurify sanitization intact but mutate during the browser's second parse, breaking out of the wrapper context and activating injected event handlers. A working public proof-of-concept is confirmed in the GHSA advisory; no CISA KEV listing at time of analysis.

Technical ContextAI

DOMPurify (npm: dompurify, CPE: cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*) is a JavaScript HTML sanitization library maintained by cure53. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation) arising from a classic mXSS re-contextualization pattern: DOMPurify correctly sanitizes input in one HTML parsing context, but the application subsequently injects the sanitized string into a second, semantically different context via innerHTML combined with HTML5 'special element' wrappers. Per HTML5 parsing rules, elements like xmp and noscript suppress normal tag parsing within their content, treating the interior as raw text. An attacker-controlled attribute value embedding a closing sequence (e.g., </xmp>) causes the browser to terminate the special context prematurely during the second parse, re-exposing attacker markup - such as <img onerror=alert()> - as active DOM nodes outside the original attribute boundary. The sanitizer never sees the second parse and therefore cannot intercept the mutation.

RemediationAI

Upgrade DOMPurify to version 3.3.2 or later using npm install dompurify@3.3.2 - this is the vendor-released patch confirmed by the cure53 GitHub Security Advisory GHSA-h8r8-wccr-v5f2 (https://github.com/cure53/DOMPurify/security/advisories/GHSA-h8r8-wccr-v5f2). As a compensating control where immediate upgrade is not feasible, eliminate re-insertion of sanitized output via innerHTML inside the confirmed vulnerable wrapper elements (script, xmp, iframe, noembed, noframes, noscript) - this removes the second parse context that triggers mutation; trade-off is that it may require refactoring rendering logic. Alternatively, sanitize the full composed string (wrapper included) rather than sanitizing content before wrapper concatenation, though this approach is brittle and not a substitute for patching. Using textContent for trusted text fragments instead of innerHTML avoids parser re-entry entirely where markup rendering is not needed. Upgrading to 3.3.2 is the only reliable remediation.

More in Dompurify

View all
CVE-2024-47875 MEDIUM POC
6.1 Oct 11

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated medium severity (CVSS 6
CVE-2020-26870 MEDIUM POC
6.1 Oct 07

Cure53 DOMPurify before 2.0.17 allows mutation XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp
CVE-2019-16728 MEDIUM POC
6.1 Sep 24

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demo
CVE-2024-48910 CRITICAL
9.8 Oct 31

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated critical severity (CVSS
CVE-2026-65902 MEDIUM POC
5.3 Jul 23

Hook mutation pollution in DOMPurify <= 3.4.5 allows persistent bypass of HTML sanitization defaults when application-in
CVE-2026-65899 MEDIUM POC
5.1 Jul 23

Trusted Types policy state contamination in DOMPurify 3.0.0-3.4.8 allows a previously supplied TRUSTED_TYPES_POLICY to s
CVE-2026-65913 MEDIUM POC
5.1 Jul 23

Prototype pollution in DOMPurify's USE_PROFILES mode enables DOM-based XSS by causing the sanitizer to accept event hand
CVE-2026-65912 MEDIUM POC
5.1 Jul 23

URI validation bypass in DOMPurify 3.3.1 and earlier allows `javascript:` protocol payloads to survive HTML sanitization
CVE-2026-65900 MEDIUM POC
5.1 Jul 23

SAFE_FOR_TEMPLATES bypass in DOMPurify 3.0.0-3.4.7 allows template expressions such as ${evil}, {{evil}}, and <%evil%> t
CVE-2026-65901 MEDIUM POC
5.1 Jul 23

Cross-site scripting in DOMPurify 3.4.6 and earlier enables script execution when the library's IN_PLACE sanitization mo
CVE-2026-65898 MEDIUM POC
5.1 Jul 23

Stored XSS is achievable in applications using DOMPurify's setConfig() API combined with an uponSanitizeAttribute hook t
CVE-2025-26791 MEDIUM POC
4.5 Feb 14

DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site sc

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Module for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise Server for SAP applications 16.0 Affected

Share

EUVD-2026-48277 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy