Every CVE Search/ Get API key

CVE-2026-0540

DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML

5.3 MediumFix available

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
None

Exploit likelihood

0.39%Up 0.4 points since Mar 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.

Record
CVE-2026-0540
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2026-9303 5.3

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.

Record
EUVD-2026-9303
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-v2wj-7wpq-c8vv 5.1

DOMPurify contains a Cross-site Scripting vulnerability

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in 2.5.9 and 3.3.2, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.

Record
GHSA-v2wj-7wpq-c8vv
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 5.3

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.

Record
CVE-2026-0540
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 5.3

DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.

Record
CVE-2026-0540
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
OSVDEBIAN-CVE-2026-0540 5.3

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.

Record
DEBIAN-CVE-2026-0540
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 12 moreShow less
OSVGHSA-v2wj-7wpq-c8vv 5.1

DOMPurify contains a Cross-site Scripting vulnerability

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in 2.5.9 and 3.3.2, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.

Record
GHSA-v2wj-7wpq-c8vv
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVUBUNTU-CVE-2026-0540 5.3

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.

Record
UBUNTU-CVE-2026-0540
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Updated
2026-11-02
OSVCLSA-2026-1778460305 No score

TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.1.6-tuxcare.2.

Record
CLSA-2026-1778460305
Updated
2026-11-02
OSVCLSA-2026-1778805976 No score

TuxCare security update for dompurify (10 CVEs)

TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.2.3-tuxcare.1.

Record
CLSA-2026-1778805976
Updated
2026-11-02
OSVCLSA-2026-1784596279 No score

TuxCare security update for dompurify (7 CVEs)

TuxCare rebuilt dompurify to address 7 CVEs. Fixed in 3.0.3-tuxcare.2.

Record
CLSA-2026-1784596279
Updated
2026-11-02
OSVCLSA-2026-1789139223 No score

TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.2.7-tuxcare.2.

Record
CLSA-2026-1789139223
Updated
2026-11-02
OSVCLSA-2026-1789155876 No score

TuxCare security update for dompurify (8 CVEs)

TuxCare rebuilt dompurify to address 8 CVEs. Fixed in 2.5.8-tuxcare.7.

Record
CLSA-2026-1789155876
Updated
2026-11-02
OSVCLSA-2026-1792155851 No score

TuxCare security update for dompurify (12 CVEs)

TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.1.3-tuxcare.2.

Record
CLSA-2026-1792155851
Updated
2026-11-02
OSVCLSA-2026-1792156282 No score

TuxCare security update for dompurify (11 CVEs)

TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.1.4-tuxcare.2.

Record
CLSA-2026-1792156282
Updated
2026-11-02
OSVCLSA-2026-1792161492 No score

TuxCare security update for dompurify (10 CVEs)

TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.2.6-tuxcare.2.

Record
CLSA-2026-1792161492
Updated
2026-11-02
OSVopenSUSE-SU-2026:10599-1 No score

cacti-1.2.30+git306.82d5aef5-1.1 on GA media

These are all security issues fixed in the cacti-1.2.30+git306.82d5aef5-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10599-1
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-0540 No score

CVE-2026-0540 in dompurify - Patched by Root

Root has patched CVE-2026-0540 in the dompurify package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-0540
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dompurify
npm
 3.1.3 to 3.3.1
3.3.2
dompurify
npm
 2.5.3 to 2.5.8
2.5.9
dompurify
TuxCare:npm
 3.1.6-tuxcare.0 up to 3.1.6-tuxcare.2, plus listed versions
3.1.63.1.6-tuxcare.1
3.1.6-tuxcare.2
dompurify
TuxCare:npm
 3.2.3-tuxcare.0 up to 3.2.3-tuxcare.1, plus listed versions
3.2.3
3.2.3-tuxcare.1
dompurify
TuxCare:npm
 3.0.3-tuxcare.0 up to 3.0.3-tuxcare.2, plus listed versions
3.0.33.0.3-tuxcare.1
3.0.3-tuxcare.2
dompurify
TuxCare:npm
 3.2.7-tuxcare.0 up to 3.2.7-tuxcare.2, plus listed versions
3.2.73.2.7-tuxcare.1
3.2.7-tuxcare.2
dompurify
TuxCare:npm
 2.5.8-tuxcare.0 up to 2.5.8-tuxcare.7, plus listed versions
2.5.82.5.8-tuxcare.12.5.8-tuxcare.22.5.8-tuxcare.32.5.8-tuxcare.42.5.8-tuxcare.52.5.8-tuxcare.6
2.5.8-tuxcare.7
dompurify
TuxCare:npm
 3.1.3-tuxcare.0 up to 3.1.3-tuxcare.2, plus listed versions
3.1.33.1.3-tuxcare.1
3.1.3-tuxcare.2
dompurify
TuxCare:npm
 3.1.4-tuxcare.0 up to 3.1.4-tuxcare.2, plus listed versions
3.1.43.1.4-tuxcare.1
3.1.4-tuxcare.2
dompurify
TuxCare:npm
 3.2.6-tuxcare.0 up to 3.2.6-tuxcare.2, plus listed versions
3.2.63.2.6-tuxcare.1
3.2.6-tuxcare.2
Show 13 moreShow less
Affected packages
PackageAffectedFixed
node-dompurify
Debian:12
 All versions, plus listed versions
2.4.1+dfsg+~2.4.0-12.4.1+dfsg+~2.4.0-22.4.1+dfsg+~2.4.0-2+deb12u13.0.9+dfsg+~3.0.5-13.1.6+dfsg+~3.0.5-1
Show 13 moreShow less
3.1.7+dfsg+~3.0.5-13.1.7+dfsg+~3.0.5-23.2.5+dfsg-13.3.2+dfsg-13.3.3+dfsg-13.3.3+dfsg-23.4.1+dfsg-13.4.12+dfsg-13.4.13+dfsg-13.4.13+dfsg-23.4.16+dfsg-13.4.2+dfsg-13.4.5+dfsg-1
 None known
node-dompurify
Debian:13
 All versions, plus listed versions
3.1.7+dfsg+~3.0.5-23.2.5+dfsg-13.3.2+dfsg-13.3.3+dfsg-13.3.3+dfsg-2
Show 7 moreShow less
3.4.1+dfsg-13.4.12+dfsg-13.4.13+dfsg-13.4.13+dfsg-23.4.16+dfsg-13.4.2+dfsg-13.4.5+dfsg-1
 None known
node-dompurify
Debian:14
 before 3.3.2+dfsg-1, plus listed versions
3.1.7+dfsg+~3.0.5-23.2.5+dfsg-1
3.3.2+dfsg-1
dompurify
npm
 3.1.3 up to 3.3.2
3.3.2
dompurify
npm
 2.5.3 up to 2.5.9
2.5.9
dompurify
Root:npm
 before 2.5.8-aikido.3
2.5.8-aikido.33.2.4-aikido.12.5.8-aikido.13.2.4-aikido.23.2.4-aikido.32.5.8-aikido.23.2.4-aikido.43.2.4-aikido.5
@rootio/dompurify
Root:npm
 before 2.5.8-root.io.3
2.5.8-root.io.33.2.4-root.io.12.5.8-root.io.13.2.4-root.io.23.2.4-root.io.32.5.8-root.io.23.2.4-root.io.43.2.4-root.io.5
node-dompurify
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.3.0+dfsg-22.3.3+dfsg-1
 None known
node-dompurify
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.4.1+dfsg+~2.4.0-13.0.9+dfsg+~3.0.5-1
 None known
node-dompurify
Ubuntu:25.10
 All versions, plus listed versions
3.1.7+dfsg+~3.0.5-13.1.7+dfsg+~3.0.5-2
 None known
node-dompurify
Ubuntu:26.10
 All versions, plus listed versions
3.3.3+dfsg-13.4.2+dfsg-13.4.5+dfsg-13.4.12+dfsg-13.4.13+dfsg-13.4.13+dfsg-2
 None known
node-dompurify
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.1.7+dfsg+~3.0.5-23.3.3+dfsg-1
 None known
cacti
openSUSE:Tumbleweed
 before 1.2.30+git306.82d5aef5-1.1
1.2.30+git306.82d5aef5-1.1

History

History
RecordedChangedSources
facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-0540 is a medium vulnerability (CVSS 5.3) in Cure53 Dompurify, published March 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in dompurify 3.3.2.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open