Cross-site scripting in DOMPurify - CVE-2025-26791

Vulnerability identifier: #VU105783

CSH Severity: Low

CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L]

CVE-ID: CVE-2025-26791

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform mutation cross-site scripting (XSS) attacks.

The vulnerability exists due to DOMPurify has an incorrect template literal regular expression. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

DOMPurify
QRadar Investigation Assistant
Aspera Desktop App
watsonx Orchestrate Developer Edition
Storage Defender - Resiliency Service
DB2 Data Management Console
IBM Cloud Pak for Watson AIOps
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Knowledge Catalog Premium Cartridge
Maximo Application Suite - Monitor Component
Maximo Application Suite - Visual Inspection Component
IBM Security QRadar Log Management AQL Plugin
IBM Fusion HCI
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
Primavera P6 Enterprise Project Portfolio Management
IBM Observability with Instana
IBM Cloud Pak for Security
Ansible Automation Platform
IBM Decision Optimization for Cloud Pak for Data
IBM Maximo Application Suite - Manage Component
IBM Maximo Application Suite
App Connect Enterprise Certified Container
Oracle Utilities Application Framework
Oracle Insurance Policy Administration
Splunk Machine Learning Toolkit
Communications Unified Assurance
Jazz Reporting Service
Fedora
Oracle Communications Cloud Native Core Network Function Cloud Native Environment
python3.11-jsonschema-path (Red Hat package)
python3.11-galaxy-importer (Red Hat package)
python3.11-referencing (Red Hat package)
ansible-rulebook (Red Hat package)
automation-eda-controller (Red Hat package)
receptor (Red Hat package)
ansible-automation-platform-installer (Red Hat package)
automation-gateway (Red Hat package)
python3.11-django-ansible-base (Red Hat package)
jupyterlab
automation-controller (Red Hat package)
python3.11-typing-extensions (Red Hat package)
python3.11-galaxy-ng (Red Hat package)
automation-hub (Red Hat package)
python3.11-podman (Red Hat package)
ansible-creator (Red Hat package)
python3.11-tox-ansible (Red Hat package)
python3.11-pytest-ansible (Red Hat package)
ansible-dev-environment (Red Hat package)
ansible-navigator (Red Hat package)
python3.11-ansible-compat (Red Hat package)
ansible-lint (Red Hat package)
molecule (Red Hat package)
ansible-dev-tools (Red Hat package)
nextcloud
Planning Analytics Local

Install updates from vendor's website.

DOMPurify - update to 3.2.4
QRadar Investigation Assistant - update to 1.1.1
IBM Security QRadar Log Management AQL Plugin - update to 1.1.3
Aspera Desktop App - update to 1.0.8
watsonx Orchestrate Developer Edition - update to 1.15.0
Storage Defender - Resiliency Service - update to 2.0.13
IBM Fusion HCI - update to 2.11.0
DB2 Data Management Console - update to 3.1.13.2
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.9, 5.2.1
IBM Cloud Pak for Watson AIOps - update to 4.10.0
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
Knowledge Catalog Premium Cartridge - update to 5.2
Splunk Machine Learning Toolkit - update to 5.6.0
Jazz Reporting Service - addressed in versions 7.0.3 iFix023, 7.1 iFix011, 7.2 iFix003
Maximo Application Suite - Monitor Component - addressed in versions 8.10.18, 8.11.16, 9.0.8, 9.1.0
Maximo Application Suite - Visual Inspection Component - update to 9.1.0
python3.11-jsonschema-path (Red Hat package) - addressed in versions 0.3.4-1.el8ap, 0.3.4-1.el9ap
python3.11-galaxy-importer (Red Hat package) - addressed in versions 0.4.28-1.el8ap, 0.4.28-1.el9ap
python3.11-referencing (Red Hat package) - addressed in versions 0.36.2-1.el8ap, 0.36.2-1.el9ap
IBM Observability with Instana - update to 1.0.293
ansible-rulebook (Red Hat package) - addressed in versions 1.1.3-1.el8ap, 1.1.3-1.el9ap
automation-eda-controller (Red Hat package) - addressed in versions 1.1.6-1.el8ap, 1.1.6-1.el9ap
receptor (Red Hat package) - addressed in versions 1.5.3-2.el8ap, 1.5.3-2.el9ap
IBM Cloud Pak for Security - update to 1.11.2.0
Planning Analytics Local - addressed in versions 2.0.0.103, 2.1.10
Ansible Automation Platform - update to 2.5
ansible-automation-platform-installer (Red Hat package) - addressed in versions 2.5-9.2.el8ap, 2.5-9.2.el9ap
automation-gateway (Red Hat package) - addressed in versions 2.5.20250312-1.el8ap, 2.5.20250312-1.el9ap
python3.11-django-ansible-base (Red Hat package) - addressed in versions 2.5.20250312-1.el8ap, 2.5.20250312-1.el9ap
jupyterlab - addressed in versions 4.3.6-1.fc40, 4.3.6-1.fc41
automation-controller (Red Hat package) - addressed in versions 4.6.9-1.el8ap, 4.6.9-1.el9ap
IBM Decision Optimization for Cloud Pak for Data - addressed in versions 4.8.9, 5.1.2
python3.11-typing-extensions (Red Hat package) - addressed in versions 4.9.0-1.el8ap, 4.9.0-1.el9ap
python3.11-galaxy-ng (Red Hat package) - addressed in versions 4.10.2-1.el8ap, 4.10.2-1.el9ap
automation-hub (Red Hat package) - addressed in versions 4.10.2-1.el8ap, 4.10.2-1.el9ap
python3.11-podman (Red Hat package) - addressed in versions 5.2.0-1.el8ap, 5.2.0-1.el9ap
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.23, 8.7.17, 9.0.10
IBM Maximo Application Suite - addressed in versions 8.10.24, 8.11.21, 9.0.10
App Connect Enterprise Certified Container - addressed in versions 12.0.9, 12.9.0
ansible-creator (Red Hat package) - addressed in versions 25.0.0-1.el8ap, 25.0.0-1.el9ap
python3.11-tox-ansible (Red Hat package) - addressed in versions 25.1.0-1.el8ap, 25.1.0-1.el9ap
python3.11-pytest-ansible (Red Hat package) - addressed in versions 25.1.0-1.el8ap, 25.1.0-1.el9ap
ansible-dev-environment (Red Hat package) - addressed in versions 25.1.0-1.el8ap, 25.1.0-1.el9ap
ansible-navigator (Red Hat package) - addressed in versions 25.1.0-1.el8ap, 25.1.0-1.el9ap
python3.11-ansible-compat (Red Hat package) - addressed in versions 25.1.2-1.el8ap, 25.1.2-1.el9ap
ansible-lint (Red Hat package) - addressed in versions 25.1.2-1.el8ap, 25.1.2-1.el9ap
molecule (Red Hat package) - addressed in versions 25.2.0-1.el8ap, 25.2.0-1.el9ap
ansible-dev-tools (Red Hat package) - addressed in versions 25.2.0-1.el8ap, 25.2.0-1.el9ap
nextcloud - addressed in versions 29.0.16-1.el9, 31.0.2-1.fc41, 31.0.2-1.fc42, 31.0.2-1.fc43, 31.0.2-2.fc40

• https://ensy.zip/posts/dompurify-323-bypass/
• https://github.com/cure53/DOMPurify/commit/d18ffcb554e0001748865da03ac75dd7829f0f02
• https://github.com/cure53/DOMPurify/releases/tag/3.2.4
• https://nsysean.github.io/posts/dompurify-323-bypass/

• Cross-site scripting in DOMPurify
• IBM App Connect Enterprise Certified Container update for DOMPurify
• Cross-site scripting in Ansible Automation Platform 2.5 packages
• IBM Aspera Desktop App update for DOMPurify
• Fedora 43 update for nextcloud
• Fedora 42 update for nextcloud
• Fedora 41 update for nextcloud
• Fedora 40 update for nextcloud
• IBM Maximo Application Suite update for DOMPurify
• IBM Maximo Application Suite - Manage Component update for DOMPurify
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service
• Fedora EPEL 9 update for nextcloud
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Multiple vulnerabilities in IBM Observability with Instana
• IBM Maximo Application Suite - Monitor Component update for DOMPurify
• Multiple vulnerabilities in IBM Planning Analytics Local - IBM Planning Analytics Workspace
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• Splunk Machine Learning Toolkit update for third-party components
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM Watson Knowledge Catalog
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for DOMPurify
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in Oracle Insurance Policy Administration
• IBM Maximo Application Suite - Visual Inspection Component update for DOMPurify
• IBM Watson Discovery update for DOMPurify
• Multiple vulnerabilities in IBM QRadar Investigation Assistant
• Multiple vulnerabilities in IBM Fusion
• Multiple vulnerabilities in IBM Security QRadar Log Management AQL Plugin
• Multiple vulnerabilities in Primavera P6 Enterprise Project Portfolio Management
• Multiple vulnerabilities in Oracle Utilities Application Framework
• IBM watsonx Orchestrate Developer Edition update for DOMPurify
• Multiple vulnerabilities in IBM DB2 Data Management Console
• Multiple vulnerabilities in IBM Knowledge Catalog Premium Cartridge
• Multiple vulnerabilities in Primavera P6 Enterprise Project Portfolio Management
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Function Cloud Native Environment
• Fedora 40 update for jupyterlab
• Fedora 41 update for jupyterlab
• Multiple vulnerabilities in IBM Jazz Reporting Service