CVE-2026-65914 Details
Description
DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper context during reparsing, reactivating dangerous markup with event handlers to execute JavaScript.
A mutation-XSS vulnerability has been identified in DOMPurify versions prior to 3.3.2. This issue arises when sanitized HTML is reinserted into certain special parsing contexts, such as 'script', 'xmp', 'iframe', 'noembed', 'noframes', or 'noscript', using 'innerHTML'. Attackers can exploit this by crafting payloads that include closing sequences to escape the wrapper context during reparsing, thereby reactivating harmful markup with event handlers that execute JavaScript.
Users are advised to update DOMPurify to version 3.3.2 or later. Additionally, avoid inserting sanitized HTML into contexts that can be manipulated with closing sequences, and use safer alternatives for HTML insertion when possible.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cure53/DOMPurify/security/advisories/GHSA-h8r8-wccr-v5f2 | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/cure53/DOMPurify/security/advisories/GHSA-h8r8-wccr-v5f2 | [email protected] | ExploitThird Party Advisory |
| https://www.vulncheck.com/advisories/dompurify-before-mutation-xss-via-re-contextualization | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cure53 dompurify | < 3.3.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | Initial Analysis | [email protected] |
| Jul 23, 2026 | New CVE Received | [email protected] |
| Jul 23, 2026 | CVE Modified | CISA-ADP |