{"schema_version":1,"title":"Cure53 DOMPurify vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 13 vulnerabilities in Cure53 DOMPurify: 3 in the last 7 days and 10 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116804, was published on 27 October 2026. 7 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0.","url":"https://junglewise.ai/threats/technologies/cure53-dompurify","json_url":"https://junglewise.ai/threats/technologies/cure53-dompurify.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/cure53-dompurify","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":1,"all_time":13,"critical":1,"exploited":0,"last_7_days":3,"last_30_days":9,"last_90_days":10,"last_365_days":12},"latest":[{"cve":"CVE-2026-116804","cvss":6.1,"slug":"cve-2026-116804-dompurify-from-3-4-4-before-3-4-17-contains-a-safe-for-templates","title":"DOMPurify SAFE_FOR_TEMPLATES bypass via shadow root content","severity":"medium","exploited":false,"published_at":"2026-10-27T00:17:12.193+00:00","url":"https://junglewise.ai/threats/cve-2026-116804-dompurify-from-3-4-4-before-3-4-17-contains-a-safe-for-templates"},{"cve":"CVE-2026-116803","cvss":6.1,"slug":"cve-2026-116803-dompurify-before-3-4-17-contains-a-cross-site-scripting","title":"DOMPurify DOM XSS in IN_PLACE hook-detached subtrees","severity":"medium","exploited":false,"published_at":"2026-10-27T00:17:11.913+00:00","url":"https://junglewise.ai/threats/cve-2026-116803-dompurify-before-3-4-17-contains-a-cross-site-scripting"},{"cve":"CVE-2026-116802","cvss":6.1,"slug":"cve-2026-116802-dompurify-before-3-4-17-contains-a-cross-site-scripting","title":"DOMPurify cross-site scripting in SMIL attributeName guard bypass","severity":"medium","exploited":false,"published_at":"2026-10-27T00:17:11.637+00:00","url":"https://junglewise.ai/threats/cve-2026-116802-dompurify-before-3-4-17-contains-a-cross-site-scripting"},{"cvss":4,"slug":"dompurify-safe-for-templates-bypass-split-template-expressions-survive-c23665cf","title":"DOMPurify SAFE_FOR_TEMPLATES bypass in shadow root content","severity":"critical","exploited":false,"published_at":"2026-10-22T16:25:31+00:00","url":"https://junglewise.ai/threats/dompurify-safe-for-templates-bypass-split-template-expressions-survive-c23665cf"},{"cvss":4,"slug":"dompurify-in-place-hook-that-removes-a-parent-or-sibling-leaves-the-3ea5d18f","title":"DOMPurify IN_PLACE event handler bypass when hook removes parent or sibling","severity":"high","exploited":false,"published_at":"2026-10-22T16:24:52+00:00","url":"https://junglewise.ai/threats/dompurify-in-place-hook-that-removes-a-parent-or-sibling-leaves-the-3ea5d18f"},{"slug":"dompurify-smil-attributename-href-guard-is-skipped-when-parser-media-15a5efd2","title":"DOMPurify SMIL attributeName=href guard bypass in XHTML mode","severity":"low","exploited":false,"published_at":"2026-10-22T16:24:23+00:00","url":"https://junglewise.ai/threats/dompurify-smil-attributename-href-guard-is-skipped-when-parser-media-15a5efd2"},{"cve":"CVE-2026-109345","cvss":6.1,"epss":0.002,"slug":"cve-2026-109345-dompurify-before-3-4-16-contains-a-cross-site-scripting","title":"DOMPurify cross-site scripting in IN_PLACE mode sanitization","severity":"medium","exploited":false,"published_at":"2026-10-12T17:17:31.217+00:00","url":"https://junglewise.ai/threats/cve-2026-109345-dompurify-before-3-4-16-contains-a-cross-site-scripting"},{"cve":"CVE-2026-109344","cvss":6.1,"epss":0.0019,"slug":"cve-2026-109344-dompurify-from-3-4-13-before-3-4-16-contains-a-cross-site","title":"DOMPurify cross-site scripting in IN_PLACE mode with afterSanitize hooks","severity":"medium","exploited":false,"published_at":"2026-10-12T17:17:31.06+00:00","url":"https://junglewise.ai/threats/cve-2026-109344-dompurify-from-3-4-13-before-3-4-16-contains-a-cross-site"},{"slug":"dompurify-in-place-returns-a-force-removed-rawtext-root-whose-text-16d9ac9e","title":"DOMPurify IN_PLACE mode XSS via rawtext element text content","severity":"info","exploited":false,"published_at":"2026-10-05T23:43:53+00:00","url":"https://junglewise.ai/threats/dompurify-in-place-returns-a-force-removed-rawtext-root-whose-text-16d9ac9e"},{"cvss":4,"slug":"dompurify-in-place-node-removing-aftersanitize-hook-leaves-detached-3087e7fd","title":"DOMPurify DOM XSS in IN_PLACE mode with afterSanitize hooks","severity":"medium","exploited":false,"published_at":"2026-09-30T15:37:57+00:00","url":"https://junglewise.ai/threats/dompurify-in-place-node-removing-aftersanitize-hook-leaves-detached-3087e7fd"},{"cve":"CVE-2026-41240","cvss":6.1,"epss":0.0031,"slug":"cve-2026-41240-dompurify-forbid-tags-bypassed-by-function-based-add-tags","title":"DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)","severity":"medium","exploited":false,"published_at":"2026-04-23T16:16:26.71+00:00","url":"https://junglewise.ai/threats/cve-2026-41240-dompurify-forbid-tags-bypassed-by-function-based-add-tags"},{"cve":"CVE-2026-0540","cvss":3.1,"epss":0.0034,"slug":"cve-2026-0540-dompurify-cross-site-scripting-in-attribute-sanitization","title":"DOMPurify cross-site scripting in attribute sanitization","severity":"low","exploited":false,"published_at":"2026-03-03T18:31:33+00:00","url":"https://junglewise.ai/threats/cve-2026-0540-dompurify-cross-site-scripting-in-attribute-sanitization"},{"cve":"CVE-2024-47875","cvss":3.1,"epss":0.0113,"slug":"cve-2024-47875-dompurify-nesting-based-mxss","title":"DOMpurify nesting-based mXSS","severity":"low","exploited":false,"published_at":"2024-10-11T17:27:29+00:00","url":"https://junglewise.ai/threats/cve-2024-47875-dompurify-nesting-based-mxss"}],"weekly":[{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-10-19","critical":1,"exploited":0,"vulnerabilities":3},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":3}],"related":[],"technology":{"hub":true,"name":"Cure53 DOMPurify","slug":"cure53-dompurify","vendor":{"hub":true,"name":"Cure53","slug":"cure53","url":"https://junglewise.ai/threats/vendors/cure53"},"aliases":[],"category":"library","description":"JavaScript library for sanitizing HTML to prevent cross-site scripting attacks.","url":"https://junglewise.ai/threats/technologies/cure53-dompurify"},"most_severe":[{"cvss":4,"slug":"dompurify-safe-for-templates-bypass-split-template-expressions-survive-c23665cf","title":"DOMPurify SAFE_FOR_TEMPLATES bypass in shadow root content","severity":"critical","exploited":false,"published_at":"2026-10-22T16:25:31+00:00","url":"https://junglewise.ai/threats/dompurify-safe-for-templates-bypass-split-template-expressions-survive-c23665cf"},{"cvss":4,"slug":"dompurify-in-place-hook-that-removes-a-parent-or-sibling-leaves-the-3ea5d18f","title":"DOMPurify IN_PLACE event handler bypass when hook removes parent or sibling","severity":"high","exploited":false,"published_at":"2026-10-22T16:24:52+00:00","url":"https://junglewise.ai/threats/dompurify-in-place-hook-that-removes-a-parent-or-sibling-leaves-the-3ea5d18f"},{"cve":"CVE-2026-41240","cvss":6.1,"epss":0.0031,"slug":"cve-2026-41240-dompurify-forbid-tags-bypassed-by-function-based-add-tags","title":"DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)","severity":"medium","exploited":false,"published_at":"2026-04-23T16:16:26.71+00:00","url":"https://junglewise.ai/threats/cve-2026-41240-dompurify-forbid-tags-bypassed-by-function-based-add-tags"},{"cve":"CVE-2026-109345","cvss":6.1,"epss":0.002,"slug":"cve-2026-109345-dompurify-before-3-4-16-contains-a-cross-site-scripting","title":"DOMPurify cross-site scripting in IN_PLACE mode sanitization","severity":"medium","exploited":false,"published_at":"2026-10-12T17:17:31.217+00:00","url":"https://junglewise.ai/threats/cve-2026-109345-dompurify-before-3-4-16-contains-a-cross-site-scripting"},{"cve":"CVE-2026-109344","cvss":6.1,"epss":0.0019,"slug":"cve-2026-109344-dompurify-from-3-4-13-before-3-4-16-contains-a-cross-site","title":"DOMPurify cross-site scripting in IN_PLACE mode with afterSanitize hooks","severity":"medium","exploited":false,"published_at":"2026-10-12T17:17:31.06+00:00","url":"https://junglewise.ai/threats/cve-2026-109344-dompurify-from-3-4-13-before-3-4-16-contains-a-cross-site"},{"cve":"CVE-2026-116804","cvss":6.1,"slug":"cve-2026-116804-dompurify-from-3-4-4-before-3-4-17-contains-a-safe-for-templates","title":"DOMPurify SAFE_FOR_TEMPLATES bypass via shadow root content","severity":"medium","exploited":false,"published_at":"2026-10-27T00:17:12.193+00:00","url":"https://junglewise.ai/threats/cve-2026-116804-dompurify-from-3-4-4-before-3-4-17-contains-a-safe-for-templates"},{"cve":"CVE-2026-116803","cvss":6.1,"slug":"cve-2026-116803-dompurify-before-3-4-17-contains-a-cross-site-scripting","title":"DOMPurify DOM XSS in IN_PLACE hook-detached subtrees","severity":"medium","exploited":false,"published_at":"2026-10-27T00:17:11.913+00:00","url":"https://junglewise.ai/threats/cve-2026-116803-dompurify-before-3-4-17-contains-a-cross-site-scripting"},{"cve":"CVE-2026-116802","cvss":6.1,"slug":"cve-2026-116802-dompurify-before-3-4-17-contains-a-cross-site-scripting","title":"DOMPurify cross-site scripting in SMIL attributeName guard bypass","severity":"medium","exploited":false,"published_at":"2026-10-27T00:17:11.637+00:00","url":"https://junglewise.ai/threats/cve-2026-116802-dompurify-before-3-4-17-contains-a-cross-site-scripting"},{"cvss":4,"slug":"dompurify-in-place-node-removing-aftersanitize-hook-leaves-detached-3087e7fd","title":"DOMPurify DOM XSS in IN_PLACE mode with afterSanitize hooks","severity":"medium","exploited":false,"published_at":"2026-09-30T15:37:57+00:00","url":"https://junglewise.ai/threats/dompurify-in-place-node-removing-aftersanitize-hook-leaves-detached-3087e7fd"},{"cve":"CVE-2024-47875","cvss":3.1,"epss":0.0113,"slug":"cve-2024-47875-dompurify-nesting-based-mxss","title":"DOMpurify nesting-based mXSS","severity":"low","exploited":false,"published_at":"2024-10-11T17:27:29+00:00","url":"https://junglewise.ai/threats/cve-2024-47875-dompurify-nesting-based-mxss"}],"generated_at":"2026-10-31T03:07:00.148028+00:00"}