# Cure53 DOMPurify vulnerabilities Source: https://junglewise.ai/threats/technologies/cure53-dompurify Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 31 October 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/cure53-dompurify.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 13 vulnerabilities in Cure53 DOMPurify: 3 in the last 7 days and 10 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116804, was published on 27 October 2026. 7 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. ## Counts - Last 7 days: 3 - Last 30 days: 9 - Last 90 days: 10 - All time: 13 (1 critical, 0 exploited in the wild) ## About Cure53 DOMPurify JavaScript library for sanitizing HTML to prevent cross-site scripting attacks. ## Latest Cure53 DOMPurify vulnerabilities - [CVE-2026-116804: DOMPurify SAFE_FOR_TEMPLATES bypass via shadow root content](https://junglewise.ai/threats/cve-2026-116804-dompurify-from-3-4-4-before-3-4-17-contains-a-safe-for-templates) (medium, CVSS 6.1, published 27 Oct 2026) - [CVE-2026-116803: DOMPurify DOM XSS in IN_PLACE hook-detached subtrees](https://junglewise.ai/threats/cve-2026-116803-dompurify-before-3-4-17-contains-a-cross-site-scripting) (medium, CVSS 6.1, published 27 Oct 2026) - [CVE-2026-116802: DOMPurify cross-site scripting in SMIL attributeName guard bypass](https://junglewise.ai/threats/cve-2026-116802-dompurify-before-3-4-17-contains-a-cross-site-scripting) (medium, CVSS 6.1, published 27 Oct 2026) - [DOMPurify SAFE_FOR_TEMPLATES bypass in shadow root content](https://junglewise.ai/threats/dompurify-safe-for-templates-bypass-split-template-expressions-survive-c23665cf) (critical, CVSS 4, published 22 Oct 2026) - [DOMPurify IN_PLACE event handler bypass when hook removes parent or sibling](https://junglewise.ai/threats/dompurify-in-place-hook-that-removes-a-parent-or-sibling-leaves-the-3ea5d18f) (high, CVSS 4, published 22 Oct 2026) - [DOMPurify SMIL attributeName=href guard bypass in XHTML mode](https://junglewise.ai/threats/dompurify-smil-attributename-href-guard-is-skipped-when-parser-media-15a5efd2) (low, published 22 Oct 2026) - [CVE-2026-109345: DOMPurify cross-site scripting in IN_PLACE mode sanitization](https://junglewise.ai/threats/cve-2026-109345-dompurify-before-3-4-16-contains-a-cross-site-scripting) (medium, CVSS 6.1, published 12 Oct 2026) - [CVE-2026-109344: DOMPurify cross-site scripting in IN_PLACE mode with afterSanitize hooks](https://junglewise.ai/threats/cve-2026-109344-dompurify-from-3-4-13-before-3-4-16-contains-a-cross-site) (medium, CVSS 6.1, published 12 Oct 2026) - [DOMPurify IN_PLACE mode XSS via rawtext element text content](https://junglewise.ai/threats/dompurify-in-place-returns-a-force-removed-rawtext-root-whose-text-16d9ac9e) (info, published 5 Oct 2026) - [DOMPurify DOM XSS in IN_PLACE mode with afterSanitize hooks](https://junglewise.ai/threats/dompurify-in-place-node-removing-aftersanitize-hook-leaves-detached-3087e7fd) (medium, CVSS 4, published 30 Sep 2026) - [CVE-2026-41240: DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)](https://junglewise.ai/threats/cve-2026-41240-dompurify-forbid-tags-bypassed-by-function-based-add-tags) (medium, CVSS 6.1, published 23 Apr 2026) - [CVE-2026-0540: DOMPurify cross-site scripting in attribute sanitization](https://junglewise.ai/threats/cve-2026-0540-dompurify-cross-site-scripting-in-attribute-sanitization) (low, CVSS 3.1, published 3 Mar 2026) - [CVE-2024-47875: DOMpurify nesting-based mXSS](https://junglewise.ai/threats/cve-2024-47875-dompurify-nesting-based-mxss) (low, CVSS 3.1, published 11 Oct 2024) ## Most severe Cure53 DOMPurify vulnerabilities - [DOMPurify SAFE_FOR_TEMPLATES bypass in shadow root content](https://junglewise.ai/threats/dompurify-safe-for-templates-bypass-split-template-expressions-survive-c23665cf) (critical, CVSS 4, published 22 Oct 2026) - [DOMPurify IN_PLACE event handler bypass when hook removes parent or sibling](https://junglewise.ai/threats/dompurify-in-place-hook-that-removes-a-parent-or-sibling-leaves-the-3ea5d18f) (high, CVSS 4, published 22 Oct 2026) - [CVE-2026-41240: DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)](https://junglewise.ai/threats/cve-2026-41240-dompurify-forbid-tags-bypassed-by-function-based-add-tags) (medium, CVSS 6.1, published 23 Apr 2026) - [CVE-2026-109345: DOMPurify cross-site scripting in IN_PLACE mode sanitization](https://junglewise.ai/threats/cve-2026-109345-dompurify-before-3-4-16-contains-a-cross-site-scripting) (medium, CVSS 6.1, published 12 Oct 2026) - [CVE-2026-109344: DOMPurify cross-site scripting in IN_PLACE mode with afterSanitize hooks](https://junglewise.ai/threats/cve-2026-109344-dompurify-from-3-4-13-before-3-4-16-contains-a-cross-site) (medium, CVSS 6.1, published 12 Oct 2026) - [CVE-2026-116804: DOMPurify SAFE_FOR_TEMPLATES bypass via shadow root content](https://junglewise.ai/threats/cve-2026-116804-dompurify-from-3-4-4-before-3-4-17-contains-a-safe-for-templates) (medium, CVSS 6.1, published 27 Oct 2026) - [CVE-2026-116803: DOMPurify DOM XSS in IN_PLACE hook-detached subtrees](https://junglewise.ai/threats/cve-2026-116803-dompurify-before-3-4-17-contains-a-cross-site-scripting) (medium, CVSS 6.1, published 27 Oct 2026) - [CVE-2026-116802: DOMPurify cross-site scripting in SMIL attributeName guard bypass](https://junglewise.ai/threats/cve-2026-116802-dompurify-before-3-4-17-contains-a-cross-site-scripting) (medium, CVSS 6.1, published 27 Oct 2026) - [DOMPurify DOM XSS in IN_PLACE mode with afterSanitize hooks](https://junglewise.ai/threats/dompurify-in-place-node-removing-aftersanitize-hook-leaves-detached-3087e7fd) (medium, CVSS 4, published 30 Sep 2026) - [CVE-2024-47875: DOMpurify nesting-based mXSS](https://junglewise.ai/threats/cve-2024-47875-dompurify-nesting-based-mxss) (low, CVSS 3.1, published 11 Oct 2024) ## Vulnerabilities per week 7 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 3 Aug 2026 | 0 | 0 | 0 | | 10 Aug 2026 | 0 | 0 | 0 | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 2 | 0 | 0 | | 19 Oct 2026 | 3 | 1 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Cure53 DOMPurify vulnerabilities", https://junglewise.ai/threats/technologies/cure53-dompurify, 31 October 2026.