21
CVEs
1
Critical
0
High
0
KEV
12
PoC
0
Unpatched C/H
95.2%
Patch Rate
0.6%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
0
MEDIUM
19
LOW
1
Monthly CVE Trend
Affected Products (6)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2019-16728 | DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.1 | 1.7% | 50 |
PoC
|
| CVE-2020-26870 | Cure53 DOMPurify before 2.0.17 allows mutation XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | MEDIUM | 6.1 | 4.9% | 50 |
PoC
|
| CVE-2024-47875 | DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | MEDIUM | 6.1 | 1.1% | 50 |
PoC
|
| CVE-2024-48910 | DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) vulnerability could allow attackers to modify object prototypes to inject properties affecting application logic. | CRITICAL | 9.8 | 1.2% | 49 |
|
| CVE-2026-65914 | Mutation-XSS in DOMPurify before 3.3.2 enables JavaScript execution in victim browsers when sanitized output is re-inserted into the DOM via innerHTML using wrapper elements such as xmp, noscript, iframe, noembed, noframes, or script. Attacker-controlled payloads containing wrapper-closing sequences (e.g., </xmp>) survive DOMPurify sanitization intact but mutate during the browser's second parse, breaking out of the wrapper context and activating injected event handlers. A working public proof-of-concept is confirmed in the GHSA advisory; no CISA KEV listing at time of analysis. | MEDIUM | 5.3 | 0.3% | 47 |
PoC
|
| CVE-2026-65902 | Hook mutation pollution in DOMPurify <= 3.4.5 allows persistent bypass of HTML sanitization defaults when application-installed hooks mutate data.allowedTags or data.allowedAttributes. Because these hook fields are direct references to the library's live DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets rather than copies, any write inside a uponSanitizeElement or uponSanitizeAttribute hook permanently widens the global allow-lists for the entire lifetime of the DOMPurify instance - meaning all subsequent sanitize() calls under default config will pass through attacker-controlled HTML using the poisoned tag or attribute name. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; real-world risk is gated on the presence of the specific hook mutation pattern in the target application. | MEDIUM | 5.3 | 0.2% | 47 |
PoC
|
| CVE-2026-65899 | Trusted Types policy state contamination in DOMPurify 3.0.0-3.4.8 allows a previously supplied TRUSTED_TYPES_POLICY to survive a clearConfig() call, poisoning subsequent sanitize() calls that request RETURN_TRUSTED_TYPE output. Any application that reuses a single DOMPurify instance across trust boundaries - where one integration sets a permissive or attacker-influenced TRUSTED_TYPES_POLICY and a later caller invokes clearConfig() expecting a clean slate - will receive a TrustedHTML object signed by the old policy, potentially enabling script execution at a Trusted Types sink. A public proof-of-concept is attached to the GHSA advisory; exploitation is not confirmed in CISA KEV. | MEDIUM | 5.1 | 0.2% | 46 |
PoC
|
| CVE-2026-65913 | Prototype pollution in DOMPurify's USE_PROFILES mode enables DOM-based XSS by causing the sanitizer to accept event handler attributes it should block. Versions up to and including 3.3.1 of the npm package rebuild ALLOWED_ATTR as a plain JavaScript array when USE_PROFILES is active, making attribute allowlist lookups traverse the prototype chain - so a polluted Array.prototype (e.g., Array.prototype.onclick = true) causes DOMPurify to silently pass through event handlers like onclick into sanitized output. A proof-of-concept is included in the vendor advisory GHSA-cj63-jhhr-wcxv; no CISA KEV listing has been identified, indicating no confirmed active exploitation at time of analysis. | MEDIUM | 5.1 | 0.2% | 46 |
PoC
|
| CVE-2026-65900 | SAFE_FOR_TEMPLATES bypass in DOMPurify 3.0.0-3.4.7 allows template expressions such as ${evil}, {{evil}}, and <%evil%> to survive sanitization when DOM output modes (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE) are used alongside SAFE_FOR_TEMPLATES: true. The final normalization pass (_scrubTemplateExpressions) employs a NodeIterator that, per DOM specification, does not descend into <template>.content - a separate DocumentFragment outside the normal child-node tree - meaning split text nodes that merge into exploitable expressions inside template content are never caught. Downstream template engines receiving this output may evaluate attacker-supplied expressions, producing XSS or template injection outcomes; no public exploit is identified at time of analysis, and the string output path is explicitly confirmed unaffected. | MEDIUM | 5.1 | 0.2% | 46 |
PoC
|
| CVE-2026-65912 | URI validation bypass in DOMPurify 3.3.1 and earlier allows `javascript:` protocol payloads to survive HTML sanitization and execute as DOM-based XSS when a crafted link is activated. The flaw exists in the `_isValidAttribute` function, which short-circuits before URI-safe validation runs when a caller-supplied predicate via `EXTRA_ELEMENT_HANDLING.attributeCheck` returns `true` for a given attribute/tag pair. Exploitation is conditioned on the consuming application using the non-default `ADD_ATTR` predicate API, but a working proof-of-concept is confirmed in the official GHSA advisory; no CISA KEV listing is present at time of analysis. | MEDIUM | 5.1 | 0.2% | 46 |
PoC
|
| CVE-2026-65898 | Stored XSS is achievable in applications using DOMPurify's setConfig() API combined with an uponSanitizeAttribute hook that conditionally permits dangerous attributes for trusted elements. The 3.4.7 patch introduced a clone-guard to prevent hook-driven allowlist mutation, but that guard lives exclusively inside _parseConfig(); setConfig() sets an internal SET_CONFIG flag that causes sanitize() to skip _parseConfig() entirely, handing hooks the live shared ALLOWED_ATTR object. One trusted render permanently poisons the allowlist for the entire DOMPurify instance lifetime, so subsequent attacker-controlled content inherits the mutated policy and retains event-handler attributes like onerror or onclick unstripped. No public exploit or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects that exploitation requires prior privilege to trigger hook pollution and passive victim interaction to realize the XSS. | MEDIUM | 5.1 | 0.2% | 46 |
PoC
|
| CVE-2026-65901 | Cross-site scripting in DOMPurify 3.4.6 and earlier enables script execution when the library's IN_PLACE sanitization mode processes attacker-supplied live DOM nodes whose nodeName property has been clobbered to masquerade as an allowed element. The vulnerability bypasses DOMPurify's existing clobbering protections, which were scoped only to form elements, leaving all other live non-form nodes susceptible to nodeName manipulation. No vendor-released patch exists at time of analysis; no public exploit code has been identified, though the GHSA advisory provides a detailed technical breakdown sufficient for exploit construction. | MEDIUM | 5.1 | 0.2% | 46 |
PoC
No patch
|
| CVE-2025-26791 | DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS). Rated medium severity (CVSS 4.5), this vulnerability is no authentication required. Public exploit code available. | MEDIUM | 4.5 | 0.2% | 43 |
PoC
|
| CVE-2025-15599 | DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. [CVSS 6.1 MEDIUM] | MEDIUM | 6.1 | 0.0% | 31 |
|
| CVE-2024-45801 | DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. | MEDIUM | 6.1 | 0.8% | 30 |
|