CVE-2025-26791

EUVD-2025-4245
DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.5 MEDIUM
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
mitreCNA
4.5 MEDIUM
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 15%
Affected Products (NVD)
VendorProductVersion
cure53dompurify
𝑥
< 3.2.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
node-dompurify
bookworm
no-dsa
bookworm (security)
vulnerable
forky
3.1.7+dfsg+~3.0.5-2
fixed
sid
3.1.7+dfsg+~3.0.5-2
fixed
trixie
3.1.7+dfsg+~3.0.5-2
fixed
Common Weakness Enumeration
References
https://ensy.zip/posts/dompurify-323-bypass/
https://github.com/cure53/DOMPurify/commit/d18ffcb554e0001748865da03ac75dd7829f0f02
https://github.com/cure53/DOMPurify/releases/tag/3.2.4
https://nsysean.github.io/posts/dompurify-323-bypass/
https://ensy.zip/posts/dompurify-323-bypass/