Cure53 Dompurify
30 CVEs affecting Cure53 Dompurify. Latest disclosed: 2026-08-18. Critical: 2, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-47875 | Critical | 10.0 | 2024-10-11 | DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability i… |
CVE-2024-48910 | Critical | 9.1 | 2024-10-31 | DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability… |
CVE-2026-47423 | High | 8.2 | 2026-07-14 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to… |
CVE-2025-48050 | High | 7.5 | 2025-05-15 | In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier… |
CVE-2024-45801 | High | 7.3 | 2024-09-16 | DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting tec… |
CVE-2026-65898 | High | 7.2 | 2026-07-23 | DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently… |
CVE-2026-41238 | Medium | 6.9 | 2026-04-23 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XS… |
CVE-2026-41239 | Medium | 6.8 | 2026-04-23 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, `SAFE_FOR_TEMPLATES` s… |
CVE-2026-66010 | Medium | 6.1 | 2026-07-24 | DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes t… |
CVE-2026-65914 | Medium | 6.1 | 2026-07-23 | DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like… |
CVE-2026-65913 | Medium | 6.1 | 2026-07-23 | DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array… |
CVE-2026-65912 | Medium | 6.1 | 2026-07-23 | DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeChe… |
CVE-2026-65911 | Medium | 6.1 | 2026-07-23 | In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) ac… |
CVE-2026-65903 | Medium | 6.1 | 2026-07-23 | DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions… |
CVE-2026-65902 | Medium | 6.1 | 2026-07-23 | DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the upon… |
CVE-2026-65901 | Medium | 6.1 | 2026-07-23 | DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attacke… |
CVE-2026-65900 | Medium | 6.1 | 2026-07-23 | DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PL… |
CVE-2026-65899 | Medium | 6.1 | 2026-07-23 | DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundar… |
CVE-2026-49978 | Medium | 6.1 | 2026-07-14 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents at… |
CVE-2026-49459 | Medium | 6.1 | 2026-07-14 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve e… |