PT-2026-22763 · Dompurify · Dompurify

Published 2026-03-03 · Updated 2026-05-18 · CVE-2025-15599

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DOMPurify versions 2.5.3 through 2.5.8 DOMPurify versions 3.1.3 through 3.2.6

Description DOMPurify contains a cross-site scripting issue that allows attackers to bypass attribute sanitization. This is due to missing textarea rawtext element validation in the SAFE FOR XML regex. Attackers can include closing rawtext tags, such as , in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The textarea element and its rawtext attribute are involved in this bypass.

Recommendations Update to DOMPurify version 3.2.7 or later. For versions 2.5.3 through 2.5.8, there is no available fix; consider alternative sanitization libraries.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CLEANSTART-2026-LC05413

CVE-2025-15599

GHSA-V8JM-5VWX-CFXM

Affected Products

Dompurify

References · 149

• https://github.com/cure53/DOMPurify/commit/c861f5a83fb8d90800f1680f855fee551161ac2b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42036 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41240 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33750 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42035 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42041 · Security Note
• https://ubuntu.com/security/CVE-2025-15599 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-15599 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33916 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42264 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-0540 · Security Note
• https://osv.dev/vulnerability/GHSA-v8jm-5vwx-cfxm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35213 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42039 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42042 · Security Note