{"id":"CVE-2026-65913","aliases":["CLSA-2026-1774743817","CLSA-2026-1774743830","CLSA-2026-1778546719","CLSA-2026-1778805976","CLSA-2026-1780274966","CLSA-2026-1780274972","CLSA-2026-1780361389","CLSA-2026-1786636600","CLSA-2026-1786636613","CLSA-2026-1786636721","CLSA-2026-1786731853","CLSA-2026-1786731948","CLSA-2026-1786731971","CLSA-2026-1787602198","CLSA-2026-1789152222","CLSA-2026-1789153936","CLSA-2026-1789154068","CLSA-2026-1789154458","CLSA-2026-1789155659","CLSA-2026-1789155876","CLSA-2026-1792155851","CLSA-2026-1792155956","CLSA-2026-1792156267","CLSA-2026-1792156282","CLSA-2026-1792156500","CLSA-2026-1792156589","CLSA-2026-1792156694","CLSA-2026-1792156803","CLSA-2026-1792156909","CLSA-2026-1792157013","CLSA-2026-1792157113","CLSA-2026-1792161408","CLSA-2026-1792161492","CLSA-2026-1792369452","CLSA-2026-1792486837","CLSA-2026-1793101871","CLSA-2026-1793102041","DEBIAN-CVE-2026-65913","EUVD-2026-48276","GHSA-2cf5-4w76-r9qv","GHSA-cj63-jhhr-wcxv","GHSA-g9r4-xpmj-mj65","GHSA-q2c6-c6pm-g3gh","GHSA-q42p-pg8m-cqh6","RHSA-2026:54517","RHSA-2026:58500","ROOT-APP-NPM-CVE-2026-65913","ROOT-APP-NPM-GHSA-2cf5-4w76-r9qv","ROOT-APP-NPM-GHSA-cj63-jhhr-wcxv","ROOT-APP-NPM-GHSA-g9r4-xpmj-mj65","ROOT-APP-NPM-GHSA-q2c6-c6pm-g3gh","ROOT-APP-NPM-GHSA-q42p-pg8m-cqh6","UBUNTU-CVE-2026-65913","openSUSE-SU-2026:12070-1"],"status":"published","title":"DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES","description":"DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00318,"percentile":0.25011,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321","CWE-471","CWE-94"],"published":"2019-06-05T14:07:48Z","modified":"2026-10-28T05:15:04Z","fixes":[{"ecosystem":"npm","package":"handlebars","fixed_in":["3.0.8","4.5.2","4.5.3","4.1.2","4.0.14","3.0.7"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"dompurify","fixed_in":["3.3.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"handlebars","fixed_in":["1.3.0-tuxcare.1","1.0.12-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-dompurify","fixed_in":["3.3.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"dompurify","fixed_in":["2.5.9-aikido.4","3.2.4-aikido.4","2.5.9-aikido.5","3.2.4-aikido.5","2.5.8-aikido.3","2.5.9-aikido.1","3.2.4-aikido.1","2.5.8-aikido.1","2.5.9-aikido.2","3.2.4-aikido.2","2.5.9-aikido.3","3.2.4-aikido.3","2.5.8-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/dompurify","fixed_in":["2.5.9-root.io.4","3.2.4-root.io.4","2.5.9-root.io.5","3.2.4-root.io.5","2.5.8-root.io.3","2.5.9-root.io.1","3.2.4-root.io.1","2.5.8-root.io.1","2.5.9-root.io.2","3.2.4-root.io.2","2.5.9-root.io.3","3.2.4-root.io.3","2.5.8-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"handlebars","fixed_in":["3.0.7-aikido.3","3.0.3-aikido.2","3.0.8-aikido.1","3.0.8-aikido.2","3.0.7-aikido.1","3.0.7-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/handlebars","fixed_in":["3.0.7-root.io.3","3.0.3-root.io.2","3.0.8-root.io.1","3.0.8-root.io.2","3.0.7-root.io.1","3.0.7-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.5.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.3.1"},{"fixed":"3.3.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.5.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.5.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.1.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.14"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0-tuxcare.0"},{"fixed":"1.3.0-tuxcare.1"}]}],"versions":["1.3.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.12-tuxcare.0"},{"fixed":"1.0.12-tuxcare.2"}]}],"versions":["1.0.12","1.0.12-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.6-tuxcare.0"},{"fixed":"3.1.6-tuxcare.3"}]}],"versions":["3.1.6","3.1.6-tuxcare.1","3.1.6-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.3-tuxcare.0"},{"fixed":"3.2.3-tuxcare.1"}]}],"versions":["3.2.3"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.3-tuxcare.0"},{"fixed":"3.0.3-tuxcare.1"}]}],"versions":["3.0.3"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0-tuxcare.0"},{"fixed":"2.4.0-tuxcare.1"}]}],"versions":["2.4.0"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.7-tuxcare.0"},{"fixed":"2.4.7-tuxcare.1"}]}],"versions":["2.4.7"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.3-tuxcare.0"},{"fixed":"3.2.3-tuxcare.3"}]}],"versions":["3.2.3","3.2.3-tuxcare.1","3.2.3-tuxcare.2"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.6-tuxcare.0"},{"fixed":"3.1.6-tuxcare.7"}]}],"versions":["3.1.6","3.1.6-tuxcare.1","3.1.6-tuxcare.2","3.1.6-tuxcare.3","3.1.6-tuxcare.4","3.1.6-tuxcare.5","3.1.6-tuxcare.6"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.7-tuxcare.0"},{"fixed":"3.2.7-tuxcare.1"}]}],"versions":["3.2.7"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0-tuxcare.0"},{"fixed":"2.3.0-tuxcare.5"}]}],"versions":["2.3.0","2.3.0-tuxcare.1","2.3.0-tuxcare.2","2.3.0-tuxcare.3","2.3.0-tuxcare.4"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0-tuxcare.0"},{"fixed":"2.4.0-tuxcare.5"}]}],"versions":["2.4.0","2.4.0-tuxcare.1","2.4.0-tuxcare.2","2.4.0-tuxcare.3","2.4.0-tuxcare.4"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.3-tuxcare.0"},{"fixed":"3.0.3-tuxcare.5"}]}],"versions":["3.0.3","3.0.3-tuxcare.1","3.0.3-tuxcare.2","3.0.3-tuxcare.3","3.0.3-tuxcare.4"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.7-tuxcare.0"},{"fixed":"2.4.7-tuxcare.5"}]}],"versions":["2.4.7","2.4.7-tuxcare.1","2.4.7-tuxcare.2","2.4.7-tuxcare.3","2.4.7-tuxcare.4"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.3-tuxcare.0"},{"fixed":"2.4.3-tuxcare.8"}]}],"versions":["2.4.3","2.4.3-tuxcare.1","2.4.3-tuxcare.2","2.4.3-tuxcare.3","2.4.3-tuxcare.4","2.4.3-tuxcare.5","2.4.3-tuxcare.6","2.4.3-tuxcare.7"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.8-tuxcare.0"},{"fixed":"2.5.8-tuxcare.7"}]}],"versions":["2.5.8","2.5.8-tuxcare.1","2.5.8-tuxcare.2","2.5.8-tuxcare.3","2.5.8-tuxcare.4","2.5.8-tuxcare.5","2.5.8-tuxcare.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.3-tuxcare.0"},{"fixed":"3.1.3-tuxcare.2"}]}],"versions":["3.1.3","3.1.3-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.3-tuxcare.0"},{"fixed":"2.3.3-tuxcare.2"}]}],"versions":["2.3.3","2.3.3-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2-tuxcare.0"},{"fixed":"3.1.2-tuxcare.2"}]}],"versions":["3.1.2","3.1.2-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.4-tuxcare.0"},{"fixed":"3.1.4-tuxcare.2"}]}],"versions":["3.1.4","3.1.4-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.8-tuxcare.0"},{"fixed":"2.0.8-tuxcare.2"}]}],"versions":["2.0.8","2.0.8-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.9-tuxcare.0"},{"fixed":"3.0.9-tuxcare.2"}]}],"versions":["3.0.9","3.0.9-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.8-tuxcare.0"},{"fixed":"3.0.8-tuxcare.2"}]}],"versions":["3.0.8","3.0.8-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.10-tuxcare.0"},{"fixed":"2.3.10-tuxcare.2"}]}],"versions":["2.3.10","2.3.10-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.1-tuxcare.0"},{"fixed":"3.0.1-tuxcare.2"}]}],"versions":["3.0.1","3.0.1-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0-tuxcare.0"},{"fixed":"3.1.0-tuxcare.2"}]}],"versions":["3.1.0","3.1.0-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.11-tuxcare.0"},{"fixed":"3.0.11-tuxcare.2"}]}],"versions":["3.0.11","3.0.11-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-tuxcare.0"},{"fixed":"3.1.1-tuxcare.2"}]}],"versions":["3.1.1","3.1.1-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.6-tuxcare.0"},{"fixed":"3.2.6-tuxcare.2"}]}],"versions":["3.2.6","3.2.6-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.6-tuxcare.0"},{"fixed":"3.0.6-tuxcare.3"}]}],"versions":["3.0.6","3.0.6-tuxcare.1","3.0.6-tuxcare.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.2-tuxcare.0"},{"fixed":"3.0.2-tuxcare.3"}]}],"versions":["3.0.2","3.0.2-tuxcare.1","3.0.2-tuxcare.2"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.5-tuxcare.0"},{"fixed":"3.0.5-tuxcare.4"}]}],"versions":["3.0.5","3.0.5-tuxcare.1","3.0.5-tuxcare.2","3.0.5-tuxcare.3"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.4-tuxcare.0"},{"fixed":"3.0.4-tuxcare.4"}]}],"versions":["3.0.4","3.0.4-tuxcare.1","3.0.4-tuxcare.2","3.0.4-tuxcare.3"],"bundled":10},{"source":"osv","ecosystem":"Debian:12","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1+dfsg+~2.4.0-1","2.4.1+dfsg+~2.4.0-2","2.4.1+dfsg+~2.4.0-2+deb12u1","3.0.9+dfsg+~3.0.5-1","3.1.6+dfsg+~3.0.5-1","3.1.7+dfsg+~3.0.5-1","3.1.7+dfsg+~3.0.5-2","3.2.5+dfsg-1","3.3.2+dfsg-1","3.3.3+dfsg-1","3.3.3+dfsg-2","3.4.1+dfsg-1","3.4.12+dfsg-1","3.4.13+dfsg-1","3.4.13+dfsg-2","3.4.16+dfsg-1","3.4.2+dfsg-1","3.4.5+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.7+dfsg+~3.0.5-2","3.2.5+dfsg-1","3.3.2+dfsg-1","3.3.3+dfsg-1","3.3.3+dfsg-2","3.4.1+dfsg-1","3.4.12+dfsg-1","3.4.13+dfsg-1","3.4.13+dfsg-2","3.4.16+dfsg-1","3.4.2+dfsg-1","3.4.5+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2+dfsg-1"}]}],"versions":["3.1.7+dfsg+~3.0.5-2","3.2.5+dfsg-1"]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.8"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.5.2"}]}]},{"source":"osv","ecosystem":"npm","package":"dompurify","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.3.2"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.8"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.5.3"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.8"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.5.3"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"4.1.0"},{"fixed":"4.1.2"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.0.14"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.7"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.3-0.1.1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.8-0.1.2.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Root:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-aikido.4"},{"fixed":"3.2.4-aikido.4"},{"fixed":"2.5.9-aikido.5"},{"fixed":"3.2.4-aikido.5"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-root.io.4"},{"fixed":"3.2.4-root.io.4"},{"fixed":"2.5.9-root.io.5"},{"fixed":"3.2.4-root.io.5"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-aikido.3"},{"fixed":"3.0.3-aikido.2"},{"fixed":"3.0.8-aikido.1"},{"fixed":"3.0.8-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-root.io.3"},{"fixed":"3.0.3-root.io.2"},{"fixed":"3.0.8-root.io.1"},{"fixed":"3.0.8-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.8-aikido.3"},{"fixed":"2.5.9-aikido.1"},{"fixed":"3.2.4-aikido.1"},{"fixed":"2.5.8-aikido.1"},{"fixed":"2.5.9-aikido.2"},{"fixed":"3.2.4-aikido.2"},{"fixed":"2.5.9-aikido.3"},{"fixed":"3.2.4-aikido.3"},{"fixed":"2.5.8-aikido.2"},{"fixed":"2.5.9-aikido.4"},{"fixed":"3.2.4-aikido.4"},{"fixed":"2.5.9-aikido.5"},{"fixed":"3.2.4-aikido.5"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.8-root.io.3"},{"fixed":"2.5.9-root.io.1"},{"fixed":"3.2.4-root.io.1"},{"fixed":"2.5.8-root.io.1"},{"fixed":"2.5.9-root.io.2"},{"fixed":"3.2.4-root.io.2"},{"fixed":"2.5.9-root.io.3"},{"fixed":"3.2.4-root.io.3"},{"fixed":"2.5.8-root.io.2"},{"fixed":"2.5.9-root.io.4"},{"fixed":"3.2.4-root.io.4"},{"fixed":"2.5.9-root.io.5"},{"fixed":"3.2.4-root.io.5"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-aikido.3"},{"fixed":"3.0.3-aikido.2"},{"fixed":"3.0.8-aikido.1"},{"fixed":"3.0.8-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-root.io.3"},{"fixed":"3.0.3-root.io.2"},{"fixed":"3.0.8-root.io.1"},{"fixed":"3.0.8-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-aikido.3"},{"fixed":"3.0.3-aikido.2"},{"fixed":"3.0.8-aikido.1"},{"fixed":"3.0.8-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-root.io.3"},{"fixed":"3.0.3-root.io.2"},{"fixed":"3.0.8-root.io.1"},{"fixed":"3.0.8-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-aikido.2"},{"fixed":"3.0.7-aikido.1"},{"fixed":"3.0.7-aikido.2"},{"fixed":"3.0.7-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-root.io.2"},{"fixed":"3.0.7-root.io.1"},{"fixed":"3.0.7-root.io.2"},{"fixed":"3.0.7-root.io.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0+dfsg-2","2.3.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1+dfsg+~2.4.0-1","3.0.9+dfsg+~3.0.5-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76.7.0.git145.b60ef1146-1.1"}]}],"bundled":40}],"products":[{"vendor":"cure53","product":"dompurify"}],"references":[{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cj63-jhhr-wcxv","tags":["vendor-advisory","Third Party Advisory","advisory","web","article","report"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-prototype-pollution-via-use-profiles","tags":["third-party-advisory","Third Party Advisory","advisory","article"]},{"url":"https://www.npmjs.com/advisories/1316","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2cf5-4w76-r9qv"},{"url":"https://github.com/cure53/DOMPurify/releases/tag/3.3.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cj63-jhhr-wcxv"},{"url":"https://www.npmjs.com/advisories/1325","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g9r4-xpmj-mj65"},{"url":"https://www.npmjs.com/advisories/1324","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q2c6-c6pm-g3gh"},{"url":"https://github.com/handlebars-lang/handlebars.js/issues/1495","tags":["web"]},{"url":"https://github.com/handlebars-lang/handlebars.js/commit/7372d4e9dffc9d70c09671aa28b9392a1577fd86","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-HANDLEBARS-173692","tags":["web"]},{"url":"https://www.npmjs.com/advisories/755","tags":["web"]},{"url":"https://github.com/handlebars-lang/handlebars.js/commit/0d6d8c335ad81bad1b672fc56b6a44f6aa472dac","tags":["web"]},{"url":"https://github.com/handlebars-lang/handlebars.js/commit/85c8783b34fc6d36145d8b53885ad0b9e3c3f9c4","tags":["web"]},{"url":"https://github.com/handlebars-lang/handlebars.js/commit/cd38583216dce3252831916323202749431c773e","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q42p-pg8m-cqh6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65913.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65913","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-65913","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54517","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73088","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73089","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45819","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16221","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65904","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65912","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65911","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65914","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65913","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54517.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2502307","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16221","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515240","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45819","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45819","tags":["advisory"]},{"url":"https://github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts#L142","tags":["article"]},{"url":"https://github.com/web-platform-dx/baseline-browser-mapping/pull/137/changes#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519","tags":["article"]},{"url":"https://www.npmjs.com/package/baseline-browser-mapping","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506426","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65904","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-4w3q-35jp-p934","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-mode","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506434","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65911","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65911","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-9p3w-6h5p-cv75","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-xss-via-add-attr-add-tags-state-leakage","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506427","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65912","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65912","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cjmm-f4jc-qw8r","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-uri-validation-bypass-via-add-attr","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506429","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65913","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506430","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65914","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65914","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-h8r8-wccr-v5f2","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-mutation-xss-via-re-contextualization","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514177","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73088","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73088","tags":["advisory"]},{"url":"https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","tags":["article"]},{"url":"https://github.com/browserslist/browserslist/releases/tag/4.28.7","tags":["article"]},{"url":"https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73089","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73089","tags":["advisory"]},{"url":"https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","tags":["article"]},{"url":"https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:58500","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65898","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65899","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65901","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65902","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58500.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506436","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65898","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65898","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-permanent-attribute-allowlist-pollution-via-setconfig","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506428","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65899","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65899","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/commit/825e617753ac1169306a542d3174a77f717a0cf6","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-vxr8-fq34-vvx9","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-trusted-types-policy-state-contamination","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506432","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65901","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65901","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-cross-site-scripting-via-in-place-nodename","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506431","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65902","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65902","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/commit/7996f1dc78eb8b7922388aed75d94a9f8fad9a36","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-76mc-f452-cxcm","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-hook-mutation-pollution-via-allowedtags","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-65913","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84370","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-65913","title":"DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES","description":"DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.","status":"published","published":"2026-07-23T13:16:24.097Z","modified":"2026-10-08T15:24:00.138Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T13:37:13.934727Z"}],"euvd":[{"id":"EUVD-2026-48276","description":"DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.","status":"published","published":"2026-07-23T13:16:24Z","modified":"2026-10-08T15:24:00Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:31.696571Z"}],"ghsa":[{"id":"GHSA-2cf5-4w76-r9qv","title":"Arbitrary Code Execution in handlebars","description":"Versions of `handlebars` prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).\n\nThe following template can be used to demonstrate the vulnerability:  \n```{{#with \"constructor\"}}\n\t{{#with split as |a|}}\n\t\t{{pop (push \"alert('Vulnerable Handlebars JS');\")}}\n\t\t{{#with (concat (lookup join (slice 0 1)))}}\n\t\t\t{{#each (slice 2 3)}}\n\t\t\t\t{{#with (apply 0 a)}}\n\t\t\t\t\t{{.}}\n\t\t\t\t{{/with}}\n\t\t\t{{/each}}\n\t\t{{/with}}\n\t{{/with}}\n{{/with}}```\n\n\n## Recommendation\n\nUpgrade to version 3.0.8, 4.5.2 or later.","status":"published","published":"2020-09-04T14:57:38Z","modified":"2024-02-07T05:08:28Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:37:36.076201Z"},{"id":"GHSA-cj63-jhhr-wcxv","title":"DOMPurify USE_PROFILES prototype pollution allows event handlers","description":"## Summary\nWhen `USE_PROFILES` is enabled, DOMPurify rebuilds `ALLOWED_ATTR` as a plain array before populating it with the requested allowlists. Because the sanitizer still looks up attributes via `ALLOWED_ATTR[lcName]`, any `Array.prototype` property that is polluted also counts as an allowlisted attribute. An attacker who can set `Array.prototype.onclick = true` (or a runtime already subject to prototype pollution) can thus force DOMPurify to keep event handlers such as `onclick` even when they are normally forbidden. The provided PoC sanitizes `\u003cimg onclick=...\u003e` with `USE_PROFILES` and adds the sanitized output to the DOM; the polluted prototype allows the event handler to survive and execute, turning what should be a blocklist into a silent XSS vector.\n\n## Impact\nPrototype pollution makes DOMPurify accept dangerous event handler attributes, which bypasses the sanitizer and results in DOM-based XSS once the sanitized markup is rendered.\n\n## Credits\nIdentified by Cantina’s Apex (https://www.cantina.security).","status":"published","published":"2026-04-03T03:45:08Z","modified":"2026-07-23T14:04:56Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:40:51.375752Z"},{"id":"GHSA-q42p-pg8m-cqh6","title":"Prototype Pollution in handlebars","description":"Versions of `handlebars` prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.\n\n\n## Recommendation\n\nFor handlebars 4.1.x upgrade to 4.1.2 or later.\nFor handlebars 4.0.x upgrade to 4.0.14 or later.","status":"published","published":"2019-06-05T14:07:48Z","modified":"2023-11-29T20:32:55Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-471"],"updated_at":"2026-11-02T14:37:22.840002Z"},{"id":"GHSA-g9r4-xpmj-mj65","title":"Prototype Pollution in handlebars","description":"Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to prototype pollution. It is possible to add or modify properties to the Object prototype through a malicious template. This may allow attackers to crash the application or execute Arbitrary Code in specific conditions.\n\n\n## Recommendation\n\nUpgrade to version 3.0.8, 4.5.3 or later.","status":"published","published":"2020-09-04T15:06:32Z","modified":"2023-01-09T05:04:02Z","cwes":["CWE-1321"],"updated_at":"2026-11-02T14:36:08.267721Z"},{"id":"GHSA-q2c6-c6pm-g3gh","title":"Arbitrary Code Execution in handlebars","description":"Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It is due to an incomplete fix for a [previous issue](https://www.npmjs.com/advisories/1316). This vulnerability can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).\n\n\n## Recommendation\n\nUpgrade to version 3.0.8, 4.5.3 or later.","status":"published","published":"2020-09-04T15:07:38Z","modified":"2023-01-09T05:04:24Z","updated_at":"2026-11-02T14:36:09.554044Z"}],"nvd":[{"id":"CVE-2026-65913","description":"DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.","status":"published","published":"2026-07-23T14:18:06.573Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:12:32.473901Z"}],"osv":[{"id":"CVE-2026-65913","title":"DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES","description":"DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.","status":"published","published":"2026-07-23T13:16:24.097Z","modified":"2026-10-28T02:30:23.850632095Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:45:14.46177Z"},{"id":"DEBIAN-CVE-2026-65913","description":"DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.","status":"published","published":"2026-07-23T14:18:06.573Z","modified":"2026-10-25T09:47:37.371945496Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:58.699079Z"},{"id":"GHSA-2cf5-4w76-r9qv","title":"Arbitrary Code Execution in handlebars","description":"Versions of `handlebars` prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).\n\nThe following template can be used to demonstrate the vulnerability:  \n```{{#with \"constructor\"}}\n\t{{#with split as |a|}}\n\t\t{{pop (push \"alert('Vulnerable Handlebars JS');\")}}\n\t\t{{#with (concat (lookup join (slice 0 1)))}}\n\t\t\t{{#each (slice 2 3)}}\n\t\t\t\t{{#with (apply 0 a)}}\n\t\t\t\t\t{{.}}\n\t\t\t\t{{/with}}\n\t\t\t{{/each}}\n\t\t{{/with}}\n\t{{/with}}\n{{/with}}```\n\n\n## Recommendation\n\nUpgrade to version 3.0.8, 4.5.2 or later.","status":"published","published":"2020-09-04T14:57:38Z","modified":"2026-09-10T03:48:33.174881747Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:34.338541Z"},{"id":"GHSA-cj63-jhhr-wcxv","title":"DOMPurify USE_PROFILES prototype pollution allows event handlers","description":"## Summary\nWhen `USE_PROFILES` is enabled, DOMPurify rebuilds `ALLOWED_ATTR` as a plain array before populating it with the requested allowlists. Because the sanitizer still looks up attributes via `ALLOWED_ATTR[lcName]`, any `Array.prototype` property that is polluted also counts as an allowlisted attribute. An attacker who can set `Array.prototype.onclick = true` (or a runtime already subject to prototype pollution) can thus force DOMPurify to keep event handlers such as `onclick` even when they are normally forbidden. The provided PoC sanitizes `\u003cimg onclick=...\u003e` with `USE_PROFILES` and adds the sanitized output to the DOM; the polluted prototype allows the event handler to survive and execute, turning what should be a blocklist into a silent XSS vector.\n\n## Impact\nPrototype pollution makes DOMPurify accept dangerous event handler attributes, which bypasses the sanitizer and results in DOM-based XSS once the sanitized markup is rendered.\n\n## Credits\nIdentified by Cantina’s Apex (https://www.cantina.security).","status":"published","published":"2026-04-03T03:45:08Z","modified":"2026-09-10T03:50:43.832723479Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"GHSA-q42p-pg8m-cqh6","title":"Prototype Pollution in handlebars","description":"Versions of `handlebars` prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.\n\n\n## Recommendation\n\nFor handlebars 4.1.x upgrade to 4.1.2 or later.\nFor handlebars 4.0.x upgrade to 4.0.14 or later.","status":"published","published":"2019-06-05T14:07:48Z","modified":"2026-09-10T03:48:23.648231681Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-471"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"RHSA-2026:54517","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-13T10:17:50Z","modified":"2026-10-20T10:11:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:58500","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-23T10:16:00Z","modified":"2026-10-20T10:11:42Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"UBUNTU-CVE-2026-65913","description":"DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.","status":"published","published":"2026-07-23T14:18:00Z","modified":"2026-07-29T10:19:00.360317225Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:53.710209Z"},{"id":"CLSA-2026-1774743817","title":"TuxCare security update for handlebars (1 CVE)","description":"TuxCare rebuilt handlebars to address 1 CVE. Fixed in 1.3.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:48.668758728Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774743830","title":"TuxCare security update for handlebars (3 CVEs)","description":"TuxCare rebuilt handlebars to address 3 CVEs. Fixed in 1.0.12-tuxcare.2.","status":"published","published":"2026-08-04T14:52:16Z","modified":"2026-10-23T19:28:13.663406058Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1778546719","title":"TuxCare security update for dompurify (6 CVEs)","description":"TuxCare rebuilt dompurify to address 6 CVEs. Fixed in 3.1.6-tuxcare.3.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:45:30.926676898Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778805976","title":"TuxCare security update for dompurify (10 CVEs)","description":"TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.2.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:45:31.523670706Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1780274966","title":"TuxCare security update for dompurify (10 CVEs)","description":"TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.0.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-10-15T09:48:03.584932787Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780274972","title":"TuxCare security update for dompurify (9 CVEs)","description":"TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 2.4.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-10-23T19:28:10.361736614Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780361389","title":"TuxCare security update for dompurify (9 CVEs)","description":"TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 2.4.7-tuxcare.1.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-10-15T09:48:03.558095016Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1786636600","title":"TuxCare security update for dompurify (16 CVEs)","description":"TuxCare rebuilt dompurify to address 16 CVEs. Fixed in 2.4.0-tuxcare.1.","status":"withdrawn","published":"2026-08-13T15:56:40Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1786636613","title":"TuxCare security update for dompurify (11 CVEs)","description":"TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 2.4.3-tuxcare.1.","status":"withdrawn","published":"2026-08-13T15:56:53Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1786636721","title":"TuxCare security update for dompurify (14 CVEs)","description":"TuxCare rebuilt dompurify to address 14 CVEs. Fixed in 2.4.7-tuxcare.1.","status":"withdrawn","published":"2026-08-13T15:58:41Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1786731853","title":"TuxCare security update for dompurify (10 CVEs)","description":"TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.2.3-tuxcare.3.","status":"published","published":"2026-08-14T18:24:13Z","modified":"2026-10-15T09:46:00.690246088Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1786731948","title":"TuxCare security update for dompurify (34 CVEs)","description":"TuxCare rebuilt dompurify to address 34 CVEs. Fixed in 3.0.3-tuxcare.1.","status":"withdrawn","published":"2026-08-14T18:25:48Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1786731971","title":"TuxCare security update for dompurify (7 CVEs)","description":"TuxCare rebuilt dompurify to address 7 CVEs. Fixed in 3.1.6-tuxcare.7.","status":"published","published":"2026-08-14T18:26:11Z","modified":"2026-10-15T09:45:59.894668945Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787602198","title":"TuxCare security update for dompurify (10 CVEs)","description":"TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.2.7-tuxcare.1.","status":"published","published":"2026-08-24T20:09:58Z","modified":"2026-10-15T09:48:03.099706625Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1789152222","title":"TuxCare security update for dompurify (11 CVEs)","description":"TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 2.3.0-tuxcare.5.","status":"published","published":"2026-09-11T18:43:42Z","modified":"2026-10-16T19:13:13.829024571Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789153936","title":"TuxCare security update for dompurify (9 CVEs)","description":"TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 2.4.0-tuxcare.5.","status":"published","published":"2026-09-11T19:12:16Z","modified":"2026-10-16T19:13:12.92826655Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789154068","title":"TuxCare security update for dompurify (12 CVEs)","description":"TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.0.3-tuxcare.5.","status":"published","published":"2026-09-11T19:14:28Z","modified":"2026-10-16T19:13:11.209772816Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789154458","title":"TuxCare security update for dompurify (9 CVEs)","description":"TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 2.4.7-tuxcare.5.","status":"published","published":"2026-09-11T19:20:58Z","modified":"2026-10-16T19:13:12.113864827Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789155659","title":"TuxCare security update for dompurify (12 CVEs)","description":"TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 2.4.3-tuxcare.8.","status":"published","published":"2026-09-11T19:40:59Z","modified":"2026-10-16T19:13:13.533550553Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789155876","title":"TuxCare security update for dompurify (8 CVEs)","description":"TuxCare rebuilt dompurify to address 8 CVEs. Fixed in 2.5.8-tuxcare.7.","status":"published","published":"2026-09-11T19:44:36Z","modified":"2026-10-16T19:13:12.430055203Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1792155851","title":"TuxCare security update for dompurify (12 CVEs)","description":"TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.1.3-tuxcare.2.","status":"published","published":"2026-10-16T13:04:11Z","modified":"2026-10-21T20:43:23.163914038Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792155956","title":"TuxCare security update for dompurify (5 CVEs)","description":"TuxCare rebuilt dompurify to address 5 CVEs. Fixed in 2.3.3-tuxcare.2.","status":"published","published":"2026-10-16T13:05:56Z","modified":"2026-10-16T16:30:44.670103861Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792156267","title":"TuxCare security update for dompurify (9 CVEs)","description":"TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 3.1.2-tuxcare.2.","status":"published","published":"2026-10-16T13:11:07Z","modified":"2026-10-21T20:43:22.742858668Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792156282","title":"TuxCare security update for dompurify (11 CVEs)","description":"TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.1.4-tuxcare.2.","status":"published","published":"2026-10-16T13:11:22Z","modified":"2026-10-21T20:43:22.552871845Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792156500","title":"TuxCare security update for dompurify (6 CVEs)","description":"TuxCare rebuilt dompurify to address 6 CVEs. Fixed in 2.0.8-tuxcare.2.","status":"published","published":"2026-10-16T13:15:00Z","modified":"2026-10-23T19:28:12.602609601Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792156589","title":"TuxCare security update for dompurify (10 CVEs)","description":"TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.0.9-tuxcare.2.","status":"published","published":"2026-10-16T13:16:29Z","modified":"2026-10-21T20:43:20.928803832Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792156694","title":"TuxCare security update for dompurify (11 CVEs)","description":"TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.0.8-tuxcare.2.","status":"published","published":"2026-10-16T13:18:14Z","modified":"2026-10-21T20:43:18.588659369Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792156803","title":"TuxCare security update for dompurify (5 CVEs)","description":"TuxCare rebuilt dompurify to address 5 CVEs. Fixed in 2.3.10-tuxcare.2.","status":"published","published":"2026-10-16T13:20:03Z","modified":"2026-10-21T20:43:18.732958917Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792156909","title":"TuxCare security update for dompurify (10 CVEs)","description":"TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.0.1-tuxcare.2.","status":"published","published":"2026-10-16T13:21:49Z","modified":"2026-10-21T20:43:22.31228165Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792157013","title":"TuxCare security update for dompurify (13 CVEs)","description":"TuxCare rebuilt dompurify to address 13 CVEs. Fixed in 3.1.0-tuxcare.2.","status":"published","published":"2026-10-16T13:23:33Z","modified":"2026-10-21T20:43:22.452640022Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792157113","title":"TuxCare security update for dompurify (12 CVEs)","description":"TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.0.11-tuxcare.2.","status":"published","published":"2026-10-16T13:25:13Z","modified":"2026-10-21T20:43:21.625485698Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792161408","title":"TuxCare security update for dompurify (8 CVEs)","description":"TuxCare rebuilt dompurify to address 8 CVEs. Fixed in 3.1.1-tuxcare.2.","status":"published","published":"2026-10-16T14:36:47Z","modified":"2026-10-21T20:43:19.85040711Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161492","title":"TuxCare security update for dompurify (10 CVEs)","description":"TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.2.6-tuxcare.2.","status":"published","published":"2026-10-16T14:38:11Z","modified":"2026-10-16T16:30:09.033084778Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792369452","title":"TuxCare security update for dompurify (6 CVEs)","description":"TuxCare rebuilt dompurify to address 6 CVEs. Fixed in 3.0.6-tuxcare.3.","status":"published","published":"2026-10-19T00:24:12Z","modified":"2026-10-19T07:45:38.150098133Z","updated_at":"2026-11-02T15:43:53.353888Z"},{"id":"CLSA-2026-1792486837","title":"TuxCare security update for dompurify (10 CVEs)","description":"TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.0.2-tuxcare.3.","status":"published","published":"2026-10-20T09:00:37Z","modified":"2026-10-20T13:45:10.571759406Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793101871","title":"TuxCare security update for dompurify (11 CVEs)","description":"TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.0.5-tuxcare.4.","status":"published","published":"2026-10-27T11:51:11Z","modified":"2026-10-27T13:30:17.537780888Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793102041","title":"TuxCare security update for dompurify (11 CVEs)","description":"TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.0.4-tuxcare.4.","status":"published","published":"2026-10-27T11:54:01Z","modified":"2026-10-27T13:30:18.443508774Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"GHSA-g9r4-xpmj-mj65","title":"Prototype Pollution in handlebars","description":"Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to prototype pollution. It is possible to add or modify properties to the Object prototype through a malicious template. This may allow attackers to crash the application or execute Arbitrary Code in specific conditions.\n\n\n## Recommendation\n\nUpgrade to version 3.0.8, 4.5.3 or later.","status":"published","published":"2020-09-04T15:06:32Z","modified":"2026-09-10T03:49:13.649783342Z","cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"GHSA-q2c6-c6pm-g3gh","title":"Arbitrary Code Execution in handlebars","description":"Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It is due to an incomplete fix for a [previous issue](https://www.npmjs.com/advisories/1316). This vulnerability can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).\n\n\n## Recommendation\n\nUpgrade to version 3.0.8, 4.5.3 or later.","status":"published","published":"2020-09-04T15:07:38Z","modified":"2026-09-10T03:48:58.277710865Z","updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"openSUSE-SU-2026:12070-1","title":"velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media","description":"These are all security issues fixed in the velociraptor-0.76.7.0.git145.b60ef1146-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-06T00:00:00Z","modified":"2026-10-07T17:23:11.433086957Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"ROOT-APP-NPM-CVE-2026-65913","title":"CVE-2026-65913 in dompurify - Patched by Root","description":"Root has patched CVE-2026-65913 in the dompurify package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-28T04:55:46Z","modified":"2026-10-28T05:15:02.869296207Z","updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"ROOT-APP-NPM-GHSA-2cf5-4w76-r9qv","title":"GHSA-2cf5-4w76-r9qv in handlebars - Patched by Root","description":"Root has patched GHSA-2cf5-4w76-r9qv in the handlebars package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-20T10:47:36Z","modified":"2026-10-20T11:15:38.540557189Z","updated_at":"2026-11-02T15:53:27.940619Z"}]},"sources_more":{"osv":4}}