1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2416 more potentially affected by CVE-2026-65898 via dompurify (>=3.0.0, <=3.4.10)

🗓️ 18 Jun 2026 14:27:37Reported by Vulners OSVType

vulnersosv🔗 osv.dev👁 2 Views

DOMPurify 3.0.0-3.4.10 vulnerable to XSS via CVE-2026-65898 affecting 2416+ transitive dependents.

Reporter	Title	Published	Views	Family All 54
IBM Security Bulletins	Security Bulletin: The Log Source Management App for IBM QRadar SIEM contains components with known vulnerabilities	14 Aug 202618:27	–	ibm
IBM Security Bulletins	Security Bulletin: The Network Threat Analytics App for IBM QRadar SIEM contains components with known vulnerabilities	14 Aug 202618:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Log Management AQL Plugin is vulnerable to using components with known vulnerabilities	10 Aug 202614:18	–	ibm
IBM Security Bulletins	Security Bulletin: Resolved multiple XSS vulnerabilities in DOMPurify (CVE-2026-49978, CVE-2026-65898, CVE-2026-66010, and others)	7 Aug 202609:26	–	ibm
IBM Security Bulletins	Security Bulletin: Resolved multiple XSS vulnerabilities in DOMPurify (CVE-2026-49978, CVE-2026-65898, CVE-2026-66010, and others)	7 Aug 202609:29	–	ibm
ATTACKERKB	CVE-2026-65898	23 Jul 202613:16	–	attackerkb
Chainguard	CVE-2026-65898 vulnerabilities	24 Jul 202620:25	–	cgr
Circl	CVE-2026-65898	23 Jul 202614:35	–	circl
CVE	CVE-2026-65898	23 Jul 202613:16	–	cve
Cvelist	CVE-2026-65898 DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig	23 Jul 202613:16	–	cvelist

07 Aug 2026 08:11Current

5.3Medium risk

Vulners AI Score5.3

CVSS 45.1

CVSS 3.17.2

EPSS0.00177

SSVC

dompurify xss cve-2026-65898 npm transitive dependency sanitization