CVE-2026-65914: DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization
DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper context during reparsing, reactivating dangerous markup with event handlers to execute JavaScript.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65914?
The severity of CVE-2026-65914 is rated at risk level 53.
How do I fix CVE-2026-65914?
To fix CVE-2026-65914, upgrade to DOMPurify version 3.3.2 or later.
What software is affected by CVE-2026-65914?
The vulnerability CVE-2026-65914 affects DOMPurify versions before 3.3.2.
What type of vulnerability is CVE-2026-65914?
CVE-2026-65914 is a mutation-XSS vulnerability with implications for web security.
How can attackers exploit CVE-2026-65914?
Attackers can exploit CVE-2026-65914 by crafting payloads that break out of the sanitized context when reinserted.