DOMPurify allows Cross-site Scripting (XSS)

MEDIO 6.1CVE-2025-26791 · GHSA-vhxf-7vqr-mrjg · Published 14/02/2025 · updated 17/06/2026

In breve

CVE-2025-26791 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda dompurify (cure53), dompurify.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.60%, superiore al 49.0% delle vulnerabilità.
Correzione: aggiornare a 3.2.4 o successiva.

Package	Affected versions	Patched versions
dompurify cure53	`< 3.2.4`	`3.2.4`
dompurify npm	`< 3.2.4`	`3.2.4`

Description

DOMPurify before 3.2.4 has an incorrect template literal regular expression when SAFE_FOR_TEMPLATES is set to true, sometimes leading to mutation cross-site scripting (mXSS).

NVD description

DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).

References

nvd.nist.gov/vuln/detail/CVE-2025-26791 · ADVISORY
cure53/DOMPurify commit d18ffcb · WEB
ensy.zip/posts/dompurify-323-bypass · WEB
cure53/DOMPurify · PACKAGE
cure53/DOMPurify release 3.2.4 · WEB
nsysean.github.io/posts/dompurify-323-bypass · WEB
ensy.zip/posts/dompurify-323-bypass · Exploit
nsysean.github.io/posts/dompurify-323-bypass · Exploit

Altre vulnerabilità di dompurify

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

dompurify

cure53

< 3.2.4

3.2.4

dompurify

npm

< 3.2.4

3.2.4

Description

DOMPurify before 3.2.4 has an incorrect template literal regular expression when SAFE_FOR_TEMPLATES is set to true, sometimes leading to mutation cross-site scripting (mXSS).

NVD description

DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).

Altre vulnerabilità di dompurify

Vedi tutto →