Mutation-XSS Vulnerability in DOMPurify by Cure53

CVE-2026-65914

What is CVE-2026-65914?

DOMPurify versions before 3.3.2 are susceptible to a mutation-XSS vulnerability that arises when sanitized HTML is reinserted into specific parsing contexts. This occurs through the use of innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Malicious attackers can exploit this flaw by crafting payloads that utilize closing sequences to escape the wrapper context during reparsing. Once this occurs, harmful markup can be reactivated, allowing the execution of arbitrary JavaScript due to the event handlers embedded within the markup.

References