Executive brief
DOMPurify is a popular security library used to clean (sanitize) user-provided HTML to prevent malicious code from running in web browsers. A vulnerability was found where specifically crafted content can bypass these protections if the cleaned HTML is later placed inside certain technical tags like 'script' or 'iframe'. If exploited, an attacker could execute unauthorized JavaScript in a user's browser, potentially leading to account takeover or the theft of sensitive information.
Technical details
A mutation-XSS (mXSS) vulnerability exists in DOMPurify versions prior to 3.3.2 due to improper handling of re-contextualization. The flaw occurs when sanitized HTML is concatenated into special 'raw text' or 'escapable raw text' elements (such as <script>, <xmp>, <iframe>, <noembed>, <noframes>, or <noscript>) and then reparsed by the browser using innerHTML. An attacker can craft a payload containing closing sequences for these tags within an attribute. While DOMPurify views the initial payload as benign, the browser's second parse 'mutates' the content, allowing the attacker to break out of the wrapper context and execute arbitrary JavaScript via event handlers. This issue is resolved in version 3.3.2.
Affected products
- cure53 DOMPurify < 3.3.2
Timeline
- 2026-03-25: advisory: Initial GitHub Security Advisory published
- 2026-07-23: disclosed: CVE-2026-65914 published to NVD
- 2026-07-23: patched: Fix confirmed in version 3.3.2