PT-2026-63994 · Dompurify · Dompurify

Caverav + 2 · CVE-2026-65914 · Published 2026-03-27 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.3.2

Description A mutation-XSS (Cross-Site Scripting) issue occurs when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers such as script, xmp, iframe, noembed, noframes, or noscript. Attackers can use closing sequences to break out of the wrapper context during reparsing, which reactivates dangerous markup containing event handlers to execute arbitrary JavaScript.

Recommendations Update to version 3.3.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-65914

GHSA-H8R8-WCCR-V5F2

Affected Products

Dompurify

References · 9

• 🔥 https://github.com/cure53/DOMPurify/security/advisories/GHSA-h8r8-wccr-v5f2 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65914.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-65914 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-65914 · Security Note
• https://osv.dev/vulnerability/GHSA-h8r8-wccr-v5f2 · Vendor Advisory
• https://github.com/cure53/DOMPurify · Note
• https://github.com/cure53/DOMPurify/releases/tag/3.3.2 · Note
• https://vulncheck.com/advisories/dompurify-before-mutation-xss-via-re-contextualization · Note
• https://t.me/CVEtracker/61047 · Telegram Post