CLSA-2026-1785554485 TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.6-tuxcare.6...

CLSA-2026-1784769607 TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.0.3-tuxcare.4...

CLSA-2026-1784596306 TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 2.5.9-tuxcare.4...

CLSA-2026-1784596279 TuxCare security update for dompurify (10 CVEs)

TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.0.3-tuxcare.2...

CLSA-2026-1784509816 TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 2.5.8-tuxcare.4...

CLSA-2026-1780274966 TuxCare security update for DOMPurify (24 CVEs)

TuxCare rebuilt DOMPurify to address 24 CVEs. Fixed in 3.0.3-tuxcare.1...

CLSA-2026-1778805976 TuxCare security update for dompurify (10 CVEs)

TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.2.3-tuxcare.1...

ROOT-APP-NPM-CVE-2026-49978 CVE-2026-49978 in @rootio/dompurify - Patched by Root

Root has patched CVE-2026-49978 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-65900 CVE-2026-65900 in @rootio/dompurify - Patched by Root

Root has patched CVE-2026-65900 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-41239 CVE-2026-41239 in @rootio/dompurify - Patched by Root

Root has patched CVE-2026-41239 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-15599 CVE-2025-15599 in @rootio/dompurify - Patched by Root

Root has patched CVE-2025-15599 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...

UBUNTU-CVE-2026-65899

DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTEDTYPESPOLICY. A later caller that requests RETURNTRUSTEDTYPE output receives a TrustedHTML...

UBUNTU-CVE-2026-65913

DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USEPROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as...

CVE-2026-65900

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...

ROOT-APP-NPM-GHSA-VXR8-FQ34-VVX9 GHSA-vxr8-fq34-vvx9 in @rootio/dompurify - Patched by Root

Root has patched GHSA-vxr8-fq34-vvx9 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...

CVE-2026-49458

creationtimestamp| type| source ---|---|--- 2026-05-26 16:03:01+00:00| published-proof-of-concept| https://github.com/cure53/DOMPurify/security/advisories/GHSA-hpcv-96wg-7vj8 2026-07-27 04:02:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrlz7oozws2o 2026-07-27...

Security Bulletin: DevOps Test Performance contains a vulnerability related to use of the DOMPurify library

Summary Due to the use of the DOMPurify library, DevOps Test Performance and Rational Performance Tester contain a cross-site scripting XSS vulnerability CVE-2025-15599, CVE-2026-0540 Vulnerability Details CVEID:CVE-2025-15599 DESCRIPTION: DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8...