XSS in Cure53 Dompurify
CVE-2026-65914
DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloa…
Vulnerability class: XSS (Cross-Site Scripting)
Affected products
- Cure53 Dompurify — versions 0, 3.3.2
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)