Description
DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cure53 | DOMPurify | < 3.2.4 | 3.2.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-dompurify | 3.1.7+dfsg+~3.0.5-2 | — |
| Debian 13 | node-dompurify | 3.1.7+dfsg+~3.0.5-2 | — |
| Debian 12 | node-dompurify | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-dompurify | No fix yet | — |
| Ubuntu 26.04 LTS | node-dompurify | No fix yet | — |
| Ubuntu 25.10 | node-dompurify | No fix yet | — |
| Ubuntu 24.04 LTS | node-dompurify | No fix yet | — |
| Ubuntu 22.04 LTS | node-dompurify | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ceph Storage 7 | ceph +25 | 2:18.2.1-381.el8cp | RHSA-2026:2769 |
| Red Hat Ceph Storage 7 | cephadm | 2:18.2.1-381.el9cp | RHSA-2026:2769 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | argocd-cli | 2.14.8-1.1 | openSUSE-SU-2025:14921-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | grafana-image-renderer | 3.12.1-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | dompurify | < 3.2.4 | 3.2.4 | GHSA-vhxf-7vqr-mrjg |
Advisories 11
- RHSA-2026:2769 Red Hat Security Advisory: Red Hat Ceph Storage 7.1 security and bug fix updates Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-2451 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 2, 2026
- WID-SEC-2026-1194 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- WID-SEC-2026-1193 Oracle Construction and Engineering: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- WID-SEC-2025-0450 Red Hat OpenShift Service Mesh Containers: Schwachstelle ermöglicht Cross-Site Scripting BSI CERT-Bund (WID) · Mar 15, 2026
- openSUSE-SU-2025:14921-1 argocd-cli-2.14.8-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0160 Oracle Construction and Engineering: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2025-1570 Oracle Insurance Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
- WID-SEC-2025-1562 Oracle Utilities Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
- WID-SEC-2025-1560 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
- NCSC-2025-0123 Kwetsbaarheden verholpen in Oracle Database Producten NCSC-NL (Netherlands) · Apr 16, 2025