Cure53 Dompurify vulnerabilities

• cure53 dompurify DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees CVE-2026-116803 Fix available 5.1 MediumOctober 26, 2026
• cure53 dompurify DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content CVE-2026-116804 Fix available 5.1 MediumOctober 22, 2026
• cure53 dompurify DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode CVE-2026-116802 Fix available 5.1 MediumOctober 22, 2026
• cure53 dompurify DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root CVE-2026-109345 Fix available 5.1 MediumOctober 5, 2026
• cure53 dompurify DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks CVE-2026-109344 Fix available 5.1 MediumSeptember 30, 2026
• cure53 dompurify DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook CVE-2026-75838 Fix available 5.1 MediumAugust 18, 2026
• cure53 dompurify DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage CVE-2026-65911 Fix available 5.1 MediumJuly 23, 2026
• cure53 dompurify DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode CVE-2026-65904 Fix available 2.3 LowJuly 23, 2026
• cure53 dompurify DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName CVE-2026-65901 Fix available 5.1 MediumJuly 23, 2026
• cure53 dompurify DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM CVE-2026-65900 Fix available 5.1 MediumJuly 23, 2026
• cure53 dompurify DOMPurify XSS via `selectedcontent` re-clone CVE-2026-47423 Public exploitFix available 8.2 HighJune 1, 2026
• cure53 dompurify DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML CVE-2026-0540 Fix available 5.3 MediumMarch 3, 2026
• cure53 dompurify In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is... CVE-2025-48050 Fix availableDisputed 7.5 HighMay 15, 2025
• cure53 dompurify DOMPurify vulnerable to tampering by prototype polution CVE-2024-48910 Public exploitFix available 9.1 CriticalOctober 31, 2024
• cure53 dompurify DOMPurify Open Redirect vulnerability CVE-2019-25155 Fix available 6.1 MediumOctober 31, 2023
• cure53 dompurify, debian linux, microsoft visual studio 2017 +2 more +4 more Cross-site Scripting in dompurify CVE-2020-26870 Fix available 6.1 MediumOctober 7, 2020
• cure53 dompurify, debian linux +1 more Cross-Site Scripting in dompurify CVE-2019-16728 Fix available 6.1 MediumSeptember 24, 2019
• cure53 dompurify DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING CVE-2026-66010 Fix available 5.1 MediumJune 5, 2019
• cure53 dompurify DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization CVE-2026-65914 Fix available 5.3 MediumJune 5, 2019
• cure53 dompurify DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES CVE-2026-65913 Fix available 5.1 MediumJune 5, 2019
• cure53 dompurify DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR CVE-2026-65912 Fix available 5.1 MediumJune 5, 2019
• cure53 dompurify DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS CVE-2026-65903 Fix available 5.1 MediumJune 5, 2019
• cure53 dompurify DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags CVE-2026-65902 Fix available 5.3 MediumJune 5, 2019
• cure53 dompurify DOMPurify before 3.4.9 Trusted Types Policy State Contamination CVE-2026-65899 Fix available 5.1 MediumJune 5, 2019
• cure53 dompurify DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig CVE-2026-65898 Fix available 5.1 MediumJune 5, 2019
• cure53 dompurify DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content CVE-2026-49978 Fix available 6.3 MediumJune 5, 2019
• cure53 dompurify DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM CVE-2026-49459 Fix available 6.1 MediumJune 5, 2019
• cure53 dompurify DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks CVE-2026-49458 Fix available 6.1 MediumJune 5, 2019
• cure53 dompurify DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) CVE-2026-41240 Fix available 6.0 MediumJune 5, 2019
• cure53 dompurify DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode CVE-2026-41239 Fix available 6.8 MediumJune 5, 2019
• cure53 dompurify DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback CVE-2026-41238 Fix available 6.9 MediumJune 5, 2019
• cure53 dompurify Arbitrary Code Execution in handlebars CVE-2025-26791 Fix available 4.5 MediumJune 5, 2019
• cure53 dompurify DOMPurify XSS via Textarea Rawtext Bypass in SAFE_FOR_XML CVE-2025-15599 Fix available 5.1 MediumJune 5, 2019
• cure53 dompurify DOMPurify nesting-based mXSS CVE-2024-47875 Public exploitFix available 10.0 CriticalJune 5, 2019
• cure53 dompurify Tampering by prototype polution in DOMPurify CVE-2024-45801 Fix available 7.3 HighJune 5, 2019