CVE-2025-26791: cure53 dompurify Cross-site Scripting
CVSS: 6.1v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2025-26791DEBIAN-CVE-2025-26791CGA-625f-wqmq-6fqhCGA-xxr8-hhc3-w898GHSA-vhxf-7vqr-mrjgopenSUSE-SU-2025:14921-1CGA-284r-pjh2-xh43CGA-2gf5-c2m5-gwf8CGA-3996-g44w-jf9pCGA-3c8w-hj79-prp6CGA-3gjj-xq7r-mr49CGA-3p76-g5h9-q2qrCGA-43vf-79mj-p4p3CGA-4jx2-q3g4-jj6gCGA-5j82-85qx-9q26CGA-5qhg-r4q4-rqj3CGA-5vrr-679v-fhw6CGA-6ghg-2g9w-fw8mCGA-6m86-cfp4-25p5CGA-6mj7-79fg-293cCGA-7249-rr42-6qwhCGA-72p4-8477-g89wCGA-775r-9j7p-6w6hCGA-7f6m-fgvm-j9v6CGA-84hh-5hj3-94pmCGA-85w3-64qp-xmrvCGA-8952-p598-7cj7CGA-8fxq-4p45-vr99CGA-8g86-4h5w-8r2cCGA-8xmr-6vmc-p24vCGA-c2w3-j9x7-w7cwCGA-cg6r-pqxq-5v8pCGA-cgwv-4483-5f43CGA-cj8r-fr7q-v44pCGA-cm63-35w8-hmwmCGA-f7cv-2cpp-pwfhCGA-g3px-g82c-7257CGA-gpjc-8v55-5qqxCGA-gx4c-f4xm-gv55CGA-h7fq-2m7v-4mgpCGA-hv4j-q445-fpfcCGA-j4pv-rmrj-p24mCGA-jgpp-4rw5-vvmvCGA-jj7g-8876-h9r6CGA-m3xm-2jvq-4hv8CGA-m42p-cw64-3x97CGA-m5cr-766w-rgggCGA-m8cc-h3fp-jh2mCGA-mcfm-gcf2-692gCGA-mj3m-rwwp-7jcvCGA-p4c6-j6gm-r5xpCGA-p9gx-vmw4-wvmrCGA-pf97-f6p5-pf42CGA-pp4h-6h68-6q96CGA-q8hr-p8g9-5rgrCGA-qc6x-wr76-3726CGA-qhr2-w65m-ch3hCGA-qq49-22w8-6248CGA-rm24-r36g-gv2rCGA-vfvp-rwfg-92jqCGA-vpxh-4qhp-wvqwCGA-vrpc-m359-w76rCGA-whh9-pf8w-f289CGA-x3wj-v8q3-hr4rCGA-x694-m798-r7x4CGA-xc8w-37w7-hgm5
Published 14-02-2025Last modified 14-02-2025
Vulnerability summary
CVE-2025-26791 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in cure53 dompurify. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.9% of scored vulnerabilities. 2 public exploits are recorded.
CVSS score
6.1/10
010
Medium · v3.1 (NVD)EPSS score
0.60%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2reference
Advisory lineage
Upstream 0 · Downstream 1 · Related 3Timeline
- 14-02-2025PublishedVulnerability first disclosed.
- 14-02-2025Last modifiedVulnerability information updated.
Description
DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).
CVSS metrics
7 scores · 7 sources · 1 versionMedium 6.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NSources7 sources · 4.5–6.1
- CVE.orgCNA4.5MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated4.5MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:NDiffers
- OSV · NpmEcosystem advisory · calculated4.5MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated4.5MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.60%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
0.00 pp
From 0.60% on 19-09-2026
19-09-202619-10-2026
EPSS score0.60%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (nsysean.github.io)
Maturity: unknown
Exploit Reference (ensy.zip)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard31 products
- grafana-image-renderer< 3.12.1-r1
- opensearch-dashboards-2< 2.19.0-r1
- opensearch-dashboards-2-alerting-dashboards-plugin< 2.19.0-r1
- opensearch-dashboards-2-anomaly-detection-dashboards-plugin< 2.19.0-r1
- opensearch-dashboards-2-config< 2.19.0-r1
Cure531 product
- dompurify< 3.2.4
Debian1 product
- node-dompurifyAll versions (No fix recorded) | < 3.1.7+dfsg+~3.0.5-2
Npm1 product
- dompurify< 3.2.4
Opensuse1 product
- argocd-cli&distro=openSUSE Tumbleweed< 2.14.8-1.1
Ubuntu1 product
- node-dompurifyAll versions (No fix recorded)
Wolfi1 product
- grafana-image-renderer< 3.12.1-r1
7 vendors · 37 products
References
14 links
Show all 14 references
- github.com/cure53/DOMPurifyPACKAGE
- lists.opensuse.org/archives/…Advisory