Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: cure53 DOMPurify 3.4.0 Clear all filters
TI-2026-46949 CVE-2026-65911

DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage

Priority LOW 29

In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00333 Published 2026-07-23 Partial fix · 3.4.0 CWE-79
TI-2026-46943 CVE-2026-65903 · GHSA-39q2-94rc-95cp

DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS

Priority LOW 23

DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00325 Published 2026-07-23 Partial fix · 3.4.0 CWE-697