Home > Vulnerability Database > CVE-2025-26791

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2025-26791

Good to know:

Date: February 13, 2025

DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).

Severity Score

4.5

Related Resources (10)

Url: https://github.com/cure53/DOMPurify/releases/tag/3.2.4

Url: https://github.com/cure53/DOMPurify

Url: https://github.com/cure53/DOMPurify/commit/d18ffcb554e0001748865da03ac75dd7829f0f02

Url: https://nsysean.github.io/posts/dompurify-323-bypass/

Url: https://nvd.nist.gov/vuln/detail/CVE-2025-26791

Url: https://ensy.zip/posts/dompurify-323-bypass/

Url: https://security-tracker.debian.org/tracker/CVE-2025-26791

Url: https://nsysean.github.io/posts/dompurify-323-bypass

Url: https://ensy.zip/posts/dompurify-323-bypass

Url: https://www.mend.io/vulnerability-database/CVE-2025-26791

Severity Score

4.5

Weakness Type (CWE)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79

Top Fix

Upgrade Version

Upgrade to version dompurify - 3.2.4;dompurify - 3.2.4

CVSS v3.1

Base Score:	4.5
Attack Vector (AV):	LOCAL
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	CHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	NONE

Do you need more information?

Contact Us