Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: cure53 DOMPurify 3.3.2 Clear all filters
TI-2026-46952 CVE-2026-65914 · GHSA-h8r8-wccr-v5f2

DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization

Priority MEDIUM 57

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00307 Published 2026-07-23 Partial fix · 3.3.2 CWE-79
TI-2026-46951 CVE-2026-65913 · GHSA-cj63-jhhr-wcxv

DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES

Priority LOW 23

DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00318 Published 2026-07-23 Partial fix · 3.3.2 CWE-1321
TI-2026-46950 CVE-2026-65912 · GHSA-cjmm-f4jc-qw8r

DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR

Priority LOW 23

DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.003 Published 2026-07-23 Partial fix · 3.3.2 CWE-79