CVE-2025-26791 DOMPurify allows Cross-site Scripting (XSS)
An attacker can execute arbitrary JavaScript via mutation XSS due to a flawed regex in DOMPurify, affecting applications using this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-26791?
CVE-2025-26791 is a medium-severity cross-site scripting vulnerability in Cure53 DOMPurify, published on 14 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).
Weakness: CWE-79
Which versions are affected by CVE-2025-26791?
2 open source packages ship an affected version, including dompurify. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
dompurify npm | All versions | 3.2.4 |
dompurify npm | All versions | 3.2.4 |
Linux distribution packages (1)
argocd-cli openSUSE:Tumbleweed | All versions | 2.14.8-1.1 |
Products include Cure53 Dompurify.
How do I fix CVE-2025-26791?
Upgrade dompurify to 3.2.4 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-26791 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-26791 exists.
Other vulnerabilities in Cure53 DOMPurify
- CVE-2024-47875 DOMPurify nesting-based mXSS
- CVE-2024-48910 DOMPurify vulnerable to tampering by prototype polution
- CVE-2026-47423 DOMPurify XSS via `selectedcontent` re-clone
- CVE-2024-45801 Tampering by prototype polution in DOMPurify
- CVE-2026-49978 DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
Sources
Also known as CLSA-2026-1774398078, CLSA-2026-1778201083, DEBIAN-CVE-2025-26791, GHSA-vhxf-7vqr-mrjg, ROOT-APP-NPM-CVE-2025-26791, UBUNTU-CVE-2025-26791 and 1 more.