CVE-2026-65914 | DOMPurify before 3.3.2 contains a mutation-XSS vulnerability… | CVSS 5.3 MEDIUM

Description

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper context during reparsing, reactivating dangerous markup with event handlers to execute JavaScript.

Metadata

CVE ID: CVE-2026-65914
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-23 12:51 UTC
Published: 2026-07-23 13:16 UTC
Last updated: 2026-07-23 13:57 UTC
Primary CWE: CWE-79
Improper Neutralization of Input During Web Page Generation …
Vendor / Product: cure53 / DOMPurify
Sources: cve.org · NVD

Severity & Metrics

5.3 MEDIUM CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
cure53	DOMPurify	—	0 < 3.3.2, 3.3.2

Weakness (CWE)

CWE	Source	Description
CWE-79	cna	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References (2)

GitHub Security Advisory (GHSA-h8r8-wccr-v5f2) https://github.com/cure53/DOMPurify/security/advisories/GHSA-h8r8-wccr-v5f2
VulnCheck Advisory: DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization https://www.vulncheck.com/advisories/dompurify-before-mutation-xss-via-re-contextualization