Description
DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper context during reparsing, reactivating dangerous markup with event handlers to execute JavaScript.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| cure53 | DOMPurify | < 3.3.2 | 3.3.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-dompurify | 3.3.2+dfsg-1 | — |
| Debian 13 | node-dompurify | No fix yet | — |
| Debian 12 | node-dompurify | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | node-dompurify | No fix yet | — |
| Ubuntu 22.04 LTS | node-dompurify | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.8-0.1.2.hum1 | RHSA-2026:58500 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.3-0.1.1.hum1 | RHSA-2026:54517 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | velociraptor | 0.76.7.0.git145.b60ef1146-1.1 | openSUSE-SU-2026:12070-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | dompurify | < 3.3.2 | 3.3.2 | GHSA-h8r8-wccr-v5f2 |
Advisories 5
- RHSA-2026:58500 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54517 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- openSUSE-SU-2026:12070-1 velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media SUSE / openSUSE Security Updates · Oct 7, 2026
- NCSC-2026-0315 Kwetsbaarheden verholpen in Oracle MySQL NCSC-NL (Netherlands) · Aug 19, 2026
- WID-SEC-2026-2903 Oracle MySQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 18, 2026
References
- GitHub Security Advisory (GHSA-h8r8-wccr-v5f2) vendor-advisory
- VulnCheck Advisory: DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization third-party-advisory