Read the docs

cure53

Records35All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

cure53 records in CISA KEV

No cure53 vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Dompurify 26 records HIGH

Records

35 records

TI-2026-34986 CVE-2026-47423 · GHSA-87xg-pxx2-7hvx

DOMPurify XSS via `selectedcontent` re-clone

Priority HIGH 69

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.0041 Published 2026-07-14 Partial fix · 3.4.5 CWE-79
TI-2025-30422 CVE-2025-48050 · GHSA-5h64-37wc-rj27

Path traversal in cure53 DOMPurify

Priority HIGH 66

In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00505 Published 2025-05-15 No fix listed CWE-24
TI-2025-19705 CVE-2025-26791 · GHSA-vhxf-7vqr-mrjg

Cross-site scripting in cure53 DOMPurify

Priority MEDIUM 60

DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00605 Published 2025-02-14 Partial fix · 3.2.4 CWE-79
TI-2026-46952 CVE-2026-65914 · GHSA-h8r8-wccr-v5f2

DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization

Priority MEDIUM 57

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00307 Published 2026-07-23 Partial fix · 3.3.2 CWE-79
TI-2026-46942 CVE-2026-65902 · GHSA-76mc-f452-cxcm

DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags

Priority MEDIUM 57

DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttribu…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00355 Published 2026-07-23 Partial fix · 3.4.7 CWE-501
TI-2026-80969 CVE-2026-116804 · GHSA-6vxf-252m-8g79

SAFE_FOR_TEMPLATES bypass in DOMPurify enables cross-site scripting

Priority MEDIUM 56

DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00178 Published 2026-10-26 Fixed in 3.4.17 CWE-79
TI-2026-80968 CVE-2026-116803 · GHSA-77h4-4vqj-j7vc

DOM XSS in DOMPurify via IN_PLACE hook-detached subtrees

Priority MEDIUM 56

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00164 Published 2026-10-26 Fixed in 3.4.17 CWE-79
TI-2026-80967 CVE-2026-116802 · GHSA-g32m-chc6-3wqf

Cross-site scripting in DOMPurify via SMIL attributeName bypass

Priority MEDIUM 56

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not…

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00217 Published 2026-10-26 Partial fix · 3.4.17 CWE-79
TI-2026-71161 CVE-2026-109345 · GHSA-cjhx-p48c-gfm9

Cross-site scripting in DOMPurify IN_PLACE mode bypasses sanitization

Priority MEDIUM 56

DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.0025 Published 2026-10-12 Fixed in 3.4.16 CWE-79
TI-2026-53084 CVE-2026-75838 · GHSA-748c-f84h-hp2v

DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

Priority MEDIUM 56

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00394 Published 2026-08-18 Partial fix · 3.4.13 CWE-79
TI-2026-47008 CVE-2026-66010 · GHSA-c2j3-45gr-mqc4

DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING

Priority MEDIUM 56

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00215 Published 2026-07-24 Partial fix · 3.4.12 CWE-79
TI-2026-46941 CVE-2026-65901 · GHSA-x4vx-rjvf-j5p4

DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName

Priority MEDIUM 56

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00285 Published 2026-07-23 Partial fix CWE-79
TI-2026-46940 CVE-2026-65900 · GHSA-gvmj-g25r-r7wr

DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM

Priority MEDIUM 56

DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.0031 Published 2026-07-23 Partial fix · 3.4.8 CWE-79
TI-2024-32607 CVE-2024-48910 · GHSA-p3vf-v8qc-cwcr

DOMPurify vulnerable to tampering by prototype polution

Priority MEDIUM 51

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01151 Published 2024-10-31 Partial fix · 2.4.2 CWE-1321
TI-2026-46944 CVE-2026-65904

DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode

Priority MEDIUM 45

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument).

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00266 Published 2026-07-23 Partial fix CWE-754
TI-2024-32129 CVE-2024-47875 · GHSA-gx9m-whjm-85jf

DOMPurify nesting-based mXSS

Priority MEDIUM 45

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01134 Published 2024-10-11 Partial fix · 2.5.0, 3.1.3 CWE-79
TI-2024-30768 CVE-2024-45801 · GHSA-mmhx-hmjr-r674

Tampering by prototype polution in DOMPurify

Priority LOW 34

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00894 Published 2024-09-16 Partial fix · 2.5.4, 3.1.3 CWE-1333
Load more
Open these records in search →