cure53 DOMPurify
32 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-116804 | 3.4.4 – < 3.4.17 | DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content | MEDIUM 5.1 | 0.2 % | ||
| CVE-2026-116803 | < 3.4.17 | DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees | MEDIUM 5.1 | 0.2 % | ||
| CVE-2026-116802 | < 3.4.17 | DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode | MEDIUM 5.1 | 0.2 % | ||
| CVE-2026-109345 | < 3.4.16 | DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-109344 | 3.4.13 – < 3.4.16 | DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks | MEDIUM 5.1 | 0.2 % | ||
| CVE-2026-75838 | < 3.4.13 | DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook | MEDIUM 5.1 | 0.4 % | ||
| CVE-2026-66010 | < 3.4.12 | DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING | MEDIUM 5.1 | 0.2 % | ||
| CVE-2026-65914 | < 3.3.2 | DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-65913 | < 3.3.2 | DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-65912 | < 3.3.2 | DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-65911 | < 3.4.0 | DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-65904 | ≤ 3.3.3 | DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode | LOW 2.3 | 0.3 % | ||
| CVE-2026-65903 | < 3.4.0 | DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-65902 | < 3.4.7 | DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-65901 | ≤ 3.4.6 | DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-65900 | 3.0.0 – < 3.4.8 | DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-65899 | < 3.4.9 | DOMPurify before 3.4.9 Trusted Types Policy State Contamination | MEDIUM 5.1 | 0.4 % | ||
| CVE-2026-65898 | < 3.4.11 | DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig | MEDIUM 5.1 | 0.2 % | ||
| CVE-2026-49978 | < 3.4.6 | DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-49459 | < 3.4.6 | DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM | MEDIUM 6.1 | 0.4 % | ||
| CVE-2026-49458 | < 3.4.6 | DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks | MEDIUM 6.1 | 0.4 % | ||
| CVE-2026-47423 | >= 3.4.4, < 3.4.5 | DOMPurify XSS via `selectedcontent` re-clone | HIGH 8.2 | 0.4 % | ||
| CVE-2026-41240 | < 3.4.0 | DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) | MEDIUM 6.0 | 0.3 % | ||
| CVE-2026-41239 | >= 1.0.10, < 3.4.0 | DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode | MEDIUM 6.8 | 0.2 % | ||
| CVE-2026-41238 | >= 3.0.1, < 3.4.0 | DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-0540 | 3.1.3 – 3.3.1 ; 2.5.3 – 2.5.8 | DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML | MEDIUM 5.3 | 0.4 % | ||
| CVE-2025-15599 | 3.1.3 – 3.2.6 ; 2.5.3 – 2.5.8 | DOMPurify XSS via Textarea Rawtext Bypass in SAFE_FOR_XML | MEDIUM 5.1 | 0.3 % | ||
| CVE-2025-48050 | ≤ 3.2.5 | In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. | HIGH 7.5 | 0.5 % | ||
| CVE-2025-26791 | < 3.2.4 | DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS). | MEDIUM 6.1 | 0.6 % | ||
| CVE-2024-48910 | < 2.4.2 | DOMPurify vulnerable to tampering by prototype polution | CRITICAL 9.8 | 1.2 % | ||
| CVE-2024-47875 | < 2.5.0 ; < 3.1.3 | DOMPurify nesting-based mXSS | CRITICAL 10.0 | 1.1 % | ||
| CVE-2024-45801 | < 2.5.4 ; >=3.0.0, < 3.1.3 | Tampering by prototype polution in DOMPurify | HIGH 7.3 | 0.9 % |