UBUNTU-CVE-2026-65914

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-65914

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65914.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-65914

Upstream

CVE-2026-65914

Published

2026-07-23T14:18:00Z

Modified

2026-07-30T11:00:21Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper context during reparsing, reactivating dangerous markup with event handlers to execute JavaScript.

References

Affected packages

Ubuntu:22.04:LTS / node-dompurify

Package

Name: node-dompurify
Purl: pkg:deb/ubuntu/node-dompurify?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.3.0+dfsg-2

2.3.3+dfsg-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "node-dompurify",
            "binary_version": "2.3.3+dfsg-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65914.json"

Ubuntu:24.04:LTS / node-dompurify