Cross-site Scripting (XSS)

🗓️ 25 Jul 2026 10:18:14Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 19 Views

XSS in DOMPurify occurs when custom elements bypass sanitization via tagNameCheck, enabling dangerous attributes in innerHTML sinks to execute JavaScript.

Reporter	Title	Published	Views	Family All 53
IBM Security Bulletins	Security Bulletin: IBM Cyber Fraud includes components with multiple known vulnerabilities	20 Aug 202614:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Cluster Performance Insights uses ansible_core-2.19.11, postcss-8.5.10 and dompurify-3.4.11 which are vulnerable to CVE-2026-16493, CVE-2026-45623, CVE-2026-69153 and CVE-2026-66010	28 Aug 202610:04	–	ibm
IBM Security Bulletins	Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in DOMPurify	4 Sep 202613:35	–	ibm
IBM Security Bulletins	Security Bulletin: Uncontrolled resource consumption, cross-site scripting, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service	29 Sep 202600:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	14 Sep 202615:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Log Management AQL Plugin is vulnerable to using components with known vulnerabilities	10 Aug 202614:18	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-66010, CVE-2026-54515, CVE-2026-59889, CVE-2026-49844, CVE-2026-69153)	28 Aug 202605:58	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerabilities exists in cyclops of IBM Netezza Appliance	7 Sep 202606:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watsonx BI Assistant for CP4D affected by multiple CVEs	9 Sep 202619:32	–	ibm
IBM Security Bulletins	Security Bulletin: Resolved multiple XSS vulnerabilities in DOMPurify (CVE-2026-49978, CVE-2026-65898, CVE-2026-66010, and others)	31 Aug 202615:05	–	ibm

Vulners

Node

cure53 dompurifyRange0.4.0–3.4.11js

Source	Link
github	www.github.com/cure53/DOMPurify/commit/a9ca1e537422319a557a9a2aa61f003b23b4a197
vulncheck	www.vulncheck.com/advisories/dompurify-before-hook-bypass-via-custom-element-handling
github	www.github.com/cure53/DOMPurify/security/advisories/GHSA-c2j3-45gr-mqc4

27 Jul 2026 12:04Current

6.1Medium risk

Vulners AI Score6.1

CVSS 45.1

CVSS 3.16.1

EPSS0.00305

SSVC