What’s Vulnerable › Vulnerabilities

CVE-2026-0540: DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-03 · updated 2026-06-17
• Weakness: CWE-79

Description

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.

Affected products

• cure53 DOMPurify: from 2.5.3 through 2.5.8; from 3.1.3 through 3.3.1

References

• https://fluidattacks.com/advisories/daft
• https://github.com/cure53/DOMPurify
• https://github.com/cure53/DOMPurify/commit/302b51de22535cc90235472c52e3401bedd46f80
• https://github.com/cure53/DOMPurify/releases/tag/3.3.2
• https://www.vulncheck.com/advisories/dompurify-xss-via-missing-rawtext-elements-in-safe-for-xml

Get alerted when CVE-2026-0540 or the next vulnerability affects your stack