CVE-2026-65903: cure53 dompurify Incorrect Comparison
CVSS: 6.1v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2026-65903DEBIAN-CVE-2026-65903CGA-8w8v-ffc5-jpq6CGA-f2vv-qpx3-c9xpCGA-f94f-qg6m-mm67CGA-j75m-7h6v-5wfvCGA-r6fq-37q2-hj5cCGA-w6g9-2gxc-mrg9CGA-ww9w-7g95-2fpwCGA-x2c2-fqq9-mh28GHSA-39q2-94rc-95cpCGA-2769-hrf5-8pw7CGA-27jw-xww2-j67mCGA-29rj-pp38-274mCGA-2g34-8fcw-m3pwCGA-2j4w-62f3-qp4mCGA-38c6-rcw8-62wcCGA-3h7j-4425-qjhmCGA-3wmm-j8hw-5778CGA-4464-53v2-h924CGA-44jm-7924-7rw9CGA-4g7c-9p9w-mx3vCGA-4gj6-hf5x-746cCGA-4h3h-f2mm-535hCGA-5974-h76f-gj97CGA-5c5g-5qf9-cq6qCGA-5chw-68mq-6wh8CGA-5hfq-jgxq-fcvjCGA-5rc6-m9wc-5rpcCGA-5v8p-cqhc-xmhvCGA-6334-fwpp-68x4CGA-75g6-xrvc-36rjCGA-79r8-jqj2-rhfcCGA-7p2j-55hv-hh3gCGA-7xgf-28j4-wj57CGA-82pp-q5c8-mj8rCGA-84v5-h5gj-3592CGA-8q3g-2g3x-24x6CGA-953r-88w4-xv99CGA-9993-862h-m4p5CGA-9cgv-ppcq-pqjmCGA-9qh6-qx95-vm7jCGA-9r6x-8vhq-p5f3CGA-9v2h-cx3j-jpg8CGA-c5jx-rjwh-4vg9CGA-c7g7-43jh-g395CGA-ccr3-5wm7-q8qrCGA-cq5p-f3jx-w55xCGA-f3m4-g25g-4v65CGA-f8xr-fv8r-3f75CGA-f943-mmrh-3mppCGA-fgcr-fmw5-8g86CGA-fh44-g5x5-v2xrCGA-fqh3-jwwq-wvfgCGA-g34q-j4w2-xmf3CGA-g72q-2rcq-wgcfCGA-gq8q-426v-h3j6CGA-gwjc-23q6-vw45CGA-h897-3gq9-wqqcCGA-hpmj-9rx6-vcwhCGA-j83r-3fxc-prrfCGA-jcc7-9vp5-2wmjCGA-jfqv-xr73-mx78CGA-jxxh-j9q2-f443CGA-mc95-mg4p-3gprCGA-mhcv-mp79-4g4cCGA-mj4m-9p2f-98hcCGA-mpqc-7467-w6ppCGA-p32m-372q-2ff3CGA-p4mh-9m3g-q26xCGA-p9wp-563f-fxgqCGA-pcqp-4222-pj7xCGA-pgc2-823v-f4qxCGA-ph24-rw72-mcpfCGA-pmg6-289f-2m3pCGA-qr53-pjxv-4vg9CGA-qv6p-7q3r-h4mwCGA-r7h9-6w45-hg7vCGA-rjr9-f26g-q7h2CGA-rppq-rhxj-3g2pCGA-v483-j865-mmg6CGA-v95v-97gp-457mCGA-v967-2x3x-v323CGA-vcc6-9qvr-r52pCGA-vcx4-p37v-wwfrCGA-vfp5-94r9-38rpCGA-vvf2-49vp-7q9pCGA-wc9f-65v2-9g59CGA-wrrv-xfjv-h3vjCGA-wwf8-vwwj-r2h9CGA-x9gv-rf43-898fCGA-xgc8-4mph-7mf4CGA-xhp2-jqjw-49frCGA-xx25-647p-84wxCGA-xxvf-4wcr-72xxCGA-xxwf-443f-cvh2
Published 23-07-2026Last modified 23-07-2026
Vulnerability summary
CVE-2026-65903 is a medium (CVSS 6.1) Incorrect Comparison vulnerability in cure53 dompurify. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.1% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
6.1/10
010
Medium · v3.1 (CVE.org)EPSS score
0.33%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 23-07-2026PublishedVulnerability first disclosed.
- 23-07-2026Last modifiedVulnerability information updated.
Description
DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.
CVSS metrics
10 scores · 7 sources · 2 versionsMedium 5.1Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:NSources7 sources · 5.1–5.3
- OSV · UbuntuEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- OSV · DebianEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- OSV · NpmEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:NDiffers
- OSV · ChainguardEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- NVDNIST5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 6.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
24%
Versus all other CVEs
30-day change
0.00 pp
From 0.33% on 20-09-2026
20-09-202620-10-2026
EPSS score0.33%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundDompurify
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard43 products
- airflow-2All versions (No fix recorded)
- airflow-core-2All versions (No fix recorded)
- gitlab-rails-ce-18.1All versions (No fix recorded)
- gitlab-rails-ce-18.10All versions (No fix recorded)
- gitlab-rails-ce-18.11All versions (No fix recorded)
Wolfi4 products
- langfuse-3< 3.164.0-r6
- langfuse-3-worker< 3.164.0-r6
- nextcloud-server-33< 33.0.6-r0
- opensearch-dashboards-3< 3.6.0-r3
Cure531 product
- dompurify< 3.4.0
Debian1 product
- node-dompurifyAll versions (No fix recorded) | < 3.4.1+dfsg-1
Npm1 product
- dompurify< 3.4.0
Ubuntu1 product
- node-dompurifyAll versions (No fix recorded)
6 vendors · 51 products
References
8 links- github.com/cure53/DOMPurify/security/advisories/GHSA-39q2-94rc-95cpVendor AdvisoryREPORTAdvisoryWEBExploitThird Party Advisory
- www.vulncheck.com/advisories/dompurify-before-add-tags-function-bypasses-forbid-tagsThird Party AdvisoryAdvisory
- github.com/cure53/DOMPurifyPACKAGE