What’s Vulnerable › Products

cure53 DOMPurify vulnerabilities

35 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 30 published in the last 12 months.

Check whether your cure53 DOMPurify version is affected

Latest cure53 DOMPurify vulnerabilities

• CVE-2026-116804 — DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content (CVSS 6.1)
• CVE-2026-116803 — DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees (CVSS 6.1)
• CVE-2026-116802 — DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode (CVSS 6.1)
• CVE-2026-109345 — DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root (CVSS 6.1)
• CVE-2026-109344 — DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks (CVSS 6.1)
• CVE-2026-75838 — DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook (CVSS 5.1)
• CVE-2026-66010 — DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING (CVSS 6.1)
• CVE-2026-65914 — DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization (CVSS 6.1)
• CVE-2026-65913 — DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES (CVSS 6.1)
• CVE-2026-65912 — DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR (CVSS 6.1)
• CVE-2026-65911 — DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage (CVSS 6.1)
• CVE-2026-65904 — DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode (CVSS 4.7)
• CVE-2026-65903 — DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS (CVSS 6.1)
• CVE-2026-65902 — DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags (CVSS 6.1)
• CVE-2026-65901 — DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName (CVSS 6.1)
• CVE-2026-65900 — DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM (CVSS 6.1)
• CVE-2026-65899 — DOMPurify before 3.4.9 Trusted Types Policy State Contamination (CVSS 6.1)
• CVE-2026-65898 — DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig (CVSS 7.2)
• CVE-2026-49978 — DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content (CVSS 6.1)
• CVE-2026-49459 — DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM (CVSS 6.1)
• CVE-2026-49458 — DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks (CVSS 6.1)
• CVE-2026-47423 — DOMPurify XSS via `selectedcontent` re-clone (CVSS 8.2)
• CVE-2026-41240 — DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) (CVSS 6.1)
• CVE-2026-41239 — DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode (CVSS 6.8)
• CVE-2026-41238 — DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback (CVSS 6.9)