Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: cure53 DOMPurify 3.4.17 Clear all filters
TI-2026-80969 CVE-2026-116804 · GHSA-6vxf-252m-8g79

SAFE_FOR_TEMPLATES bypass in DOMPurify enables cross-site scripting

Priority MEDIUM 56

DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00178 Published 2026-10-26 Fixed in 3.4.17 CWE-79
TI-2026-80968 CVE-2026-116803 · GHSA-77h4-4vqj-j7vc

DOM XSS in DOMPurify via IN_PLACE hook-detached subtrees

Priority MEDIUM 56

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00164 Published 2026-10-26 Fixed in 3.4.17 CWE-79
TI-2026-80967 CVE-2026-116802 · GHSA-g32m-chc6-3wqf

Cross-site scripting in DOMPurify via SMIL attributeName bypass

Priority MEDIUM 56

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not…

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00217 Published 2026-10-26 Partial fix · 3.4.17 CWE-79