Cure53 maintains a narrowly scoped but widely embedded open-source security library, DOMPurify, that sanitizes untrusted HTML and DOM content across countless client-side applications and frameworks. Its vulnerability profile centers on input-sanitization edge cases: cross-site scripting bypasses, prototype pollution, inefficient regex patterns, overly permissive allowlists, and open-redirect issues that reflect the inherent difficulty of maintaining a robust HTML parser and filter in a constantly evolving web-attack landscape. A meaningful share of disclosures reach serious severity; defenders should monitor this vendor's releases closely given the library's ubiquity in web applications. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Cure53 over time
Signals from CVEs in this vendor scope (26 CVEs).
26 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-47423HIGH DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an XSS paylo | Jul 14, 2026 | 8.2 | 34 | NO | NO |
CVE-2026-49978MEDIUM DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element | Jul 14, 2026 | 6.1 | 30 | NO | NO |
CVE-2026-65898HIGH DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared al | Jul 23, 2026 | 7.2 | 29 | NO | NO |
CVE-2026-49459MEDIUM DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attribut | Jul 14, 2026 | 6.1 | 29 | NO | NO |
CVE-2024-48910CRITICAL DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2. | Oct 31, 2024 | 9.8 | 29 | NO | NO |
CVE-2026-49458MEDIUM DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DO | Jul 14, 2026 | 6.1 | 28 | NO | NO |
CVE-2026-65913MEDIUM DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties | Jul 23, 2026 | 6.1 | 26 | NO | NO |
CVE-2026-65912MEDIUM DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can sup | Jul 23, 2026 | 6.1 | 26 | NO | NO |
CVE-2026-65911MEDIUM In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanit | Jul 23, 2026 | 6.1 | 26 | NO | NO |
CVE-2026-65903MEDIUM DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft | Jul 23, 2026 | 6.1 | 26 | NO | NO |
Signals from CVEs in this vendor scope (26 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Cure53.
Media articles that mention a CVE ID that affects a product developed by Cure53 — matched by CVE ID, not by vendor name.