CVE-2026-65914: cure53 DOMPurify mutation-XSS via Re-Contextualization

CVE-2026-65914 · Severity: medium · CVSS 4 · Published 2026-07-23

DOMPurify is a popular security library used to clean (sanitize) user-provided HTML to prevent malicious code from running in web browsers. A vulnerability was found where specifically crafted content can bypass these protections if the cleaned HTML is later placed inside certain technical tags like 'script' or 'iframe'. If exploited, an attacker could execute unauthorized JavaScript in a user's browser, potentially leading to account takeover or the theft of sensitive information.

Technologies: dompurify (npm). Vendors: npm.

Quick answers

Is CVE-2026-65914 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-65914 being exploited in the wild.
How severe is CVE-2026-65914?
Medium severity, with a CVSS score of 4, published 23 July 2026.
Which products and versions are affected?
dompurify (npm) < 3.3.2, SEMVER:introduced=0,fixed=3.3.2.
Is there a fix for CVE-2026-65914?
Yes. dompurify (npm): upgrade to 3.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65914 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-65914?
Check whether you run dompurify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • dompurify (npm): upgrade to 3.3.2 or later
    npm install dompurify@3.3.2

Technical details

A mutation-XSS (mXSS) vulnerability exists in DOMPurify versions prior to 3.3.2 due to improper handling of re-contextualization. The flaw occurs when sanitized HTML is concatenated into special 'raw text' or 'escapable raw text' elements (such as <script>, <xmp>, <iframe>, <noembed>, <noframes>, or <noscript>) and then reparsed by the browser using innerHTML. An attacker can craft a payload containing closing sequences for these tags within an attribute. While DOMPurify views the initial payload as benign, the browser's second parse 'mutates' the content, allowing the attacker to break out of the wrapper context and execute arbitrary JavaScript via event handlers. This issue is resolved in version 3.3.2.

Affected products

  • cure53 DOMPurify < 3.3.2

Identifiers

  • CVE-2026-65914
  • GHSA-h8r8-wccr-v5f2

Timeline

  • 2026-03-25: advisory: Initial GitHub Security Advisory published
  • 2026-07-23: disclosed: CVE-2026-65914 published to NVD
  • 2026-07-23: patched: Fix confirmed in version 3.3.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.