MEDIUM 4.5 npm
DOMPurify allows Cross-site Scripting (XSS)
GHSA-vhxf-7vqr-mrjg · CVE-2025-26791
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
DOMPurify before 3.2.4 has an incorrect template literal regular expression when SAFE_FOR_TEMPLATES is set to true, sometimes leading to mutation cross-site scripting (mXSS).
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-26791
- WEB https://github.com/cure53/DOMPurify/commit/d18ffcb554e0001748865da03ac75dd7829f0f02
- WEB https://ensy.zip/posts/dompurify-323-bypass
- PACKAGE https://github.com/cure53/DOMPurify
- WEB https://github.com/cure53/DOMPurify/releases/tag/3.2.4
- WEB https://nsysean.github.io/posts/dompurify-323-bypass
Ready to move
Start Securing
Free, no credit card | First findings in minutes