Bug 2506430 (CVE-2026-65914)

Summary: CVE-2026-65914 dompurify: DOMPurify: Cross-Site Scripting vulnerability allows arbitrary code execution
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abarbaro, akhatavk, akostadi, alizardo, amasferr, amctagga, anjoseph, anpicker, aoconnor, aos-team-art-private, asdas, ataylor, bniver, bparees, cdrage, dbruscin, dkeler, dmayorov, dpaolell, dschmidt, ehugonne, ewittman, flucifre, fmariani, gmalinko, gmeno, gparvin, groman, hasun, janstey, jchui, jdelft, jfula, jhe, jlanda, jlledo, jowilson, jprabhak, jupierce, jwong, jwon, kaycoth, kbempah, kshier, ktsao, kvanderr, lchilton, lgarciaa, mbenjamin, mbiarnes, mcarlett, mhackett, nboldt, nipatil, nyancey, oaljalju, omaciel, ometelka, pantinor, pjindal, ppalepu, ppostler, prdhamdh, psrna, ptisnovs, rhaigner, rhel-process-autobot, rkubis, rstepani, rushinde, sdawley, sfeifer, sghai, sidsharm, simaishi, solenoci, sostapov, stcannon, suppawar, syedriko, tcunning, teagle, thason, tsedmik, ttakamiy, vereddy, vlaad, watson-tool-maintainers, wtam, xdharmai, yfang, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in DOMPurify. This vulnerability, a type of Cross-Site Scripting (XSS), occurs when HTML that has been sanitized is reinserted into specific parsing contexts using innerHTML with certain HTML elements like `script` or `iframe`. An attacker can craft malicious input that, during re-parsing, can bypass the sanitization and execute arbitrary JavaScript code in the user's browser.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2520395, 2520397, 2520401, 2520403, 2520405, 2520435, 2520494, 2520496, 2520497, 2520498, 2520499, 2520503, 2520396, 2520399, 2520407, 2520411, 2520421, 2520424, 2520495, 2520500, 2520501, 2520502, 2520505, 2520506    
Bug Blocks:    

Description OSIDB Bzimport 2026-07-23 14:01:38 UTC
DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper context during reparsing, reactivating dangerous markup with event handlers to execute JavaScript.