Read the docs

cure53

Records35All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

cure53 records in CISA KEV

No cure53 vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Dompurify 26 records HIGH

Records

26 records in Dompurify · all components

TI-2026-34986 CVE-2026-47423 · GHSA-87xg-pxx2-7hvx

DOMPurify XSS via `selectedcontent` re-clone

Priority HIGH 69

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.0041 Published 2026-07-14 Partial fix · 3.4.5 CWE-79
TI-2025-19705 CVE-2025-26791 · GHSA-vhxf-7vqr-mrjg

Cross-site scripting in cure53 DOMPurify

Priority MEDIUM 60

DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00605 Published 2025-02-14 Partial fix · 3.2.4 CWE-79
TI-2026-46952 CVE-2026-65914 · GHSA-h8r8-wccr-v5f2

DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization

Priority MEDIUM 57

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00307 Published 2026-07-23 Partial fix · 3.3.2 CWE-79
TI-2026-46942 CVE-2026-65902 · GHSA-76mc-f452-cxcm

DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags

Priority MEDIUM 57

DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttribu…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00355 Published 2026-07-23 Partial fix · 3.4.7 CWE-501
TI-2026-47008 CVE-2026-66010 · GHSA-c2j3-45gr-mqc4

DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING

Priority MEDIUM 56

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00215 Published 2026-07-24 Partial fix · 3.4.12 CWE-79
TI-2026-46941 CVE-2026-65901 · GHSA-x4vx-rjvf-j5p4

DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName

Priority MEDIUM 56

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00285 Published 2026-07-23 Partial fix CWE-79
TI-2026-46940 CVE-2026-65900 · GHSA-gvmj-g25r-r7wr

DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM

Priority MEDIUM 56

DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.0031 Published 2026-07-23 Partial fix · 3.4.8 CWE-79
TI-2024-32607 CVE-2024-48910 · GHSA-p3vf-v8qc-cwcr

DOMPurify vulnerable to tampering by prototype polution

Priority MEDIUM 51

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01151 Published 2024-10-31 Partial fix · 2.4.2 CWE-1321
TI-2026-46944 CVE-2026-65904

DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode

Priority MEDIUM 45

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument).

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00266 Published 2026-07-23 Partial fix CWE-754
TI-2024-32129 CVE-2024-47875 · GHSA-gx9m-whjm-85jf

DOMPurify nesting-based mXSS

Priority MEDIUM 45

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01134 Published 2024-10-11 Partial fix · 2.5.0, 3.1.3 CWE-79
TI-2024-30768 CVE-2024-45801 · GHSA-mmhx-hmjr-r674

Tampering by prototype polution in DOMPurify

Priority LOW 34

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00894 Published 2024-09-16 Partial fix · 2.5.4, 3.1.3 CWE-1333
TI-2026-46949 CVE-2026-65911

DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage

Priority LOW 29

In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00333 Published 2026-07-23 Partial fix · 3.4.0 CWE-79
TI-2026-46939 CVE-2026-65899 · GHSA-vxr8-fq34-vvx9

DOMPurify before 3.4.9 Trusted Types Policy State Contamination

Priority LOW 29

DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY…

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00413 Published 2026-07-23 Partial fix · 3.4.9 CWE-693
TI-2026-00343 CVE-2026-0540 · GHSA-v2wj-7wpq-c8vv

DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML

Priority LOW 24

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext eleme…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00388 Published 2026-03-03 Partial fix · 3.3.2, 2.5.9 CWE-79
TI-2026-46951 CVE-2026-65913 · GHSA-cj63-jhhr-wcxv

DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES

Priority LOW 23

DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00318 Published 2026-07-23 Partial fix · 3.3.2 CWE-1321
TI-2026-46950 CVE-2026-65912 · GHSA-cjmm-f4jc-qw8r

DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR

Priority LOW 23

DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.003 Published 2026-07-23 Partial fix · 3.3.2 CWE-79
TI-2026-46943 CVE-2026-65903 · GHSA-39q2-94rc-95cp

DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS

Priority LOW 23

DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00325 Published 2026-07-23 Partial fix · 3.4.0 CWE-697
TI-2026-46938 CVE-2026-65898 · GHSA-cmwh-pvxp-8882

DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig

Priority LOW 23

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00212 Published 2026-07-23 Partial fix · 3.4.11 CWE-79
Load more
Open these records in search →