Medium severity6.1NVD Advisory· Published Jul 23, 2026· Updated Jul 28, 2026
CVE-2026-65914
CVE-2026-65914
Description
DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper context during reparsing, reactivating dangerous markup with event handlers to execute JavaScript.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
dompurifynpm | < 3.3.2 | 3.3.2 |
Affected products
3Patches
Vulnerability mechanics
References
4- github.com/cure53/DOMPurify/security/advisories/GHSA-h8r8-wccr-v5f2nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-h8r8-wccr-v5f2ghsaADVISORY
- www.vulncheck.com/advisories/dompurify-before-mutation-xss-via-re-contextualizationnvdThird Party Advisory
- github.com/cure53/DOMPurify/releases/tag/3.3.2ghsaWEB
News mentions
0No linked articles in our index yet.