We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-65914

CVE-2026-65914

React

Severity: —
CVSS: —CVSS
Published: 2026-07-23
Last modified: 2026-07-23
CWE: CWE-79

Description

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper context during reparsing, reactivating dangerous markup with event handlers to execute JavaScript.

References

https://github.com/cure53/DOMPurify/security/advisories/GHSA-h8r8-wccr-v5f2
https://www.vulncheck.com/advisories/dompurify-before-mutation-xss-via-re-contextualization

Summary

Description

References