Vulnerability · Published Jul 23, 2026 · Assigned by VulnCheck

CVE-2026-65914DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization

Medium 5.3

In plain English

A medium-severity cross-site scripting in DOMPurify from cure53. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.3%top 76.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper context during reparsing, reactivating dangerous markup with event handlers to execute JavaScript.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	node-dompurify	no fix listed	DEBIAN-CVE-2026-65914
Debian:13	node-dompurify	no fix listed	DEBIAN-CVE-2026-65914
Debian:14	node-dompurify	3.3.2+dfsg-1	DEBIAN-CVE-2026-65914
Ubuntu:22.04:LTS	node-dompurify	no fix listed	UBUNTU-CVE-2026-65914
Ubuntu:24.04:LTS	node-dompurify	no fix listed	UBUNTU-CVE-2026-65914
npm	dompurify	3.3.2	GHSA-h8r8-wccr-v5f2

Affected products (as reported)

Vendor	Product	Versions
cure53	DOMPurify	0 – before 3.3.2

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

GitHub Security Advisory (GHSA-h8r8-wccr-v5f2) vendor-advisory
VulnCheck Advisory: DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization third-party-advisory