Description

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper context during reparsing, reactivating dangerous markup with event handlers to execute JavaScript.

Remediation

References

CVE-2026-65914

Related Vulnerabilities

Oracle JRE CVE-2022-21619 Vulnerability (CVE-2022-21619)

WordPress Plugin Check & Log Email Cross-Site Scripting (0.5.1)

silverstripeCMS Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') Vulnerability (CVE-2021-41559)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-5014)

Liferay Portal URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2024-25608)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2026-65914