CVE-2025-26791

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-26791
DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).

4.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.4 / Impact : 2.7

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://ensy.zip/posts/dompurify-323-bypass/ Exploit Third Party Advisory
https://github.com/cure53/DOMPurify/commit/d18ffcb554e0001748865da03ac75dd7829f0f02 Patch
https://github.com/cure53/DOMPurify/releases/tag/3.2.4 Release Notes
https://nsysean.github.io/posts/dompurify-323-bypass/ Exploit Third Party Advisory
https://ensy.zip/posts/dompurify-323-bypass/ Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*
History

07 Oct 2025, 20:56

Type Values Removed Values Added
Summary
  • (es) DOMPurify anterior a 3.2.4 tiene una expresión regular literal de plantilla incorrecta, lo que a veces provoca Cross Site Scripting (mXSS) de mutación.
References () https://ensy.zip/posts/dompurify-323-bypass/ - () https://ensy.zip/posts/dompurify-323-bypass/ - Exploit, Third Party Advisory
References () https://github.com/cure53/DOMPurify/commit/d18ffcb554e0001748865da03ac75dd7829f0f02 - () https://github.com/cure53/DOMPurify/commit/d18ffcb554e0001748865da03ac75dd7829f0f02 - Patch
References () https://github.com/cure53/DOMPurify/releases/tag/3.2.4 - () https://github.com/cure53/DOMPurify/releases/tag/3.2.4 - Release Notes
References () https://nsysean.github.io/posts/dompurify-323-bypass/ - () https://nsysean.github.io/posts/dompurify-323-bypass/ - Exploit, Third Party Advisory
CPE cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*
First Time Cure53
Cure53 dompurify

14 Feb 2025, 16:15

Type Values Removed Values Added
References () https://ensy.zip/posts/dompurify-323-bypass/ - () https://ensy.zip/posts/dompurify-323-bypass/ -

14 Feb 2025, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-14 09:15

Updated : 2025-10-07 20:56

NVD link : CVE-2025-26791

Mitre link : CVE-2025-26791

CVE.ORG link : CVE-2025-26791

JSON object : View

Products Affected

cure53

  • dompurify
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')