CVE-2026-65914

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper context during reparsing, reactivating dangerous markup with event handlers to execute JavaScript.

CVSS 4.0

5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-25)

CWE

CWE-79

Published

2026-07-23

Modified

2026-10-24

Record from

the NVD, synced 2026-10-24

Affected

• cure53:dompurify

Packages (OSV)

References

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-h8r8-wccr-v5f2
• https://www.vulncheck.com/advisories/dompurify-before-mutation-xss-via-re-contextualization
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-h8r8-wccr-v5f2

Check your stackJSON