SB2026101338 - Multiple vulnerabilities in DOMPurify
Published: October 13, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Cross-site scripting (CVE-ID: N/A)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary JavaScript in the application's origin.
The vulnerability exists due to improper neutralization of script-capable SVG attributes in the _sanitizeAttributes function when sanitizing SVG content in XHTML parser mode. A remote attacker can supply a crafted SVG animation that bypasses the attributeName guard and changes a link's href to a JavaScript URI to execute arbitrary JavaScript in the application's origin.
Exploitation requires a non-default configuration with PARSER_MEDIA_TYPE set to application/xhtml+xml and allowlists permitting animate or set elements and the attributeName attribute. A user must click the sanitized link.
2) Cross-site scripting (CVE-ID: N/A)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary JavaScript in a victim's browser.
The vulnerability exists due to improper neutralization of event handlers in _handleHookDetachedNode() in src/purify.ts when sanitizing a live DOM tree whose application hook removes an ancestor or an unvisited sibling of the current node. A remote attacker can supply specially crafted markup containing image event handlers to execute arbitrary JavaScript in a victim's browser.
Exploitation requires IN_PLACE mode to be enabled. An image that was already loading can trigger its retained event handler after sanitize() returns, even though the returned tree is clean.
3) Cross-site scripting (CVE-ID: N/A)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to perform cross-site scripting and template injection.
The vulnerability exists due to improper neutralization of template expressions in DOMPurify's _scrubTemplateExpressions function when sanitizing DOM nodes with attached shadow roots. A remote attacker can supply shadow root content containing template expressions split across text nodes separated by disallowed elements to perform cross-site scripting and template injection.
Exploitation requires SAFE_FOR_TEMPLATES together with RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE, and the application must feed the sanitized shadow root content into a downstream template evaluator. The consequences depend on the evaluator's execution context.
Remediation
Install update from vendor's website.