CVE-2025-26791: XSS
DOMPurify before 3.2.4 has an incorrect template literal regular expression when SAFE_FOR_TEMPLATES is set to true, sometimes leading to mutation cross-site scripting (mXSS).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26791?
CVE-2025-26791 is classified as a medium severity vulnerability due to the potential for mutation cross-site scripting (mXSS).
How do I fix CVE-2025-26791?
To fix CVE-2025-26791, upgrade to DOMPurify version 3.2.4 or later, which addresses the incorrect template literal regular expression.
What is the impact of CVE-2025-26791?
The impact of CVE-2025-26791 is that it may allow an attacker to execute malicious scripts in the context of the victim's browser, leading to possible data theft or session hijacking.
Which versions of DOMPurify are affected by CVE-2025-26791?
CVE-2025-26791 affects all versions of DOMPurify prior to 3.2.4.
Is there a workaround for CVE-2025-26791 if I cannot upgrade?
Currently, there are no reliable workarounds for CVE-2025-26791, so upgrading is the recommended approach to mitigate the vulnerability.