CVE-2026-65914CWE-79

DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization

Medium · published July 23, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
22.3
In the wild
Unconfirmed
What it is

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper context during reparsing, reactivating dangerous markup with event handlers to execute JavaScript.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00307 · 22.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-23T13:16Z
EPSS history
Timeline
  • 23 JUL 13:16Z
    DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization
    cvelistv5