CVE-2026-66010: cure53 dompurify Cross-site Scripting

CVSS: 6.1v3.1MediumAnalyzed

AliasesUBUNTU-CVE-2026-66010DEBIAN-CVE-2026-66010CGA-264v-6ghf-v6cj+252 more

Published 24-07-2026Last modified 17-09-2026

Vulnerability summary

CVE-2026-66010 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in cure53 dompurify. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.8% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

34/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.1/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.30%

0%100%

Low · +0.09 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1github

Advisory lineage

Upstream 1 · Downstream 0

GHSA-JXRP-R7GX-Q4J8

Timeline

24-07-2026
PublishedVulnerability first disclosed.
17-09-2026
Last modifiedVulnerability information updated.

Description

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into innerHTML sinks, creating second-order XSS gadgets.

CVSS metrics

10 scores · 7 sources · 2 versions

v4.05.1v3.16.1

EPSS trend

Probability

0.30%

Chance of exploitation in the next 30 days

Percentile

22%

Versus all other CVEs

30-day change

+0.09 pp

From 0.21% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.30%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

githubUnverified
Dompurify
Maturity: poc

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Chainguard101 products

airflow-2All versions (No fix recorded)
airflow-core-2All versions (No fix recorded)
awx< 24.6.1-r45
gitlab-rails-ce-18.1All versions (No fix recorded)
gitlab-rails-ce-18.10All versions (No fix recorded)

gitlab-rails-ce-18.11All versions (No fix recorded)
gitlab-rails-ce-18.6All versions (No fix recorded)
gitlab-rails-ce-18.7All versions (No fix recorded)
gitlab-rails-ce-18.8All versions (No fix recorded)
gitlab-rails-ce-18.9All versions (No fix recorded)
gitlab-rails-ce-19.0All versions (No fix recorded)
gitlab-rails-ce-19.1< 19.1.7-r6
gitlab-rails-ce-19.2< 19.2.5-r2
gitlab-rails-ce-fips-18.1All versions (No fix recorded)
gitlab-rails-ce-fips-18.10< 18.10.8-r8
gitlab-rails-ce-fips-18.11< 18.11.12-r2
gitlab-rails-ce-fips-18.6All versions (No fix recorded)
gitlab-rails-ce-fips-18.7All versions (No fix recorded)
gitlab-rails-ce-fips-18.8All versions (No fix recorded)
gitlab-rails-ce-fips-18.9< 18.9.8-r8
gitlab-rails-ce-fips-19.0< 19.0.9-r3
gitlab-rails-ce-fips-19.1< 19.1.7-r7
gitlab-rails-ce-fips-19.2< 19.2.5-r2
jupyter-base-notebook< 7.6.3-r2
kibana-9.2< 9.2.8-r17
kibana-9.2-iamguarded< 9.2.8-r17
langfuse-2< 2.95.12-r35
langfuse-2-worker< 2.95.12-r35
langfuse-3-compat< 3.225.7-r6
langfuse-3-worker< 3.224.1-r0
langfuse-fips-2< 2.95.12-r38
langfuse-fips-2-worker< 2.95.12-r38
langfuse-fips-3-worker< 3.224.1-r0
librechat< 0.8.7-r5
nextcloud-server-31All versions (No fix recorded)
nextcloud-server-32< 32.0.13-r1
nextcloud-server-33< 33.0.7-r5
nextcloud-server-34< 34.0.3-r1
opensearch-dashboards-2< 2.19.6-r8
opensearch-dashboards-2-dashboards-reporting< 2.19.6-r8
opensearch-dashboards-2-fips< 2.19.5-r18
opensearch-dashboards-2-fips-alerting-dashboards-plugin< 2.19.5-r18
opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin< 2.19.5-r18
opensearch-dashboards-2-fips-dashboards-maps< 2.19.5-r18
opensearch-dashboards-2-fips-dashboards-notifications< 2.19.5-r18
opensearch-dashboards-2-fips-dashboards-observability< 2.19.5-r18
opensearch-dashboards-2-fips-dashboards-query-workbench< 2.19.5-r18
opensearch-dashboards-2-fips-dashboards-reporting< 2.19.5-r18
opensearch-dashboards-2-fips-dashboards-search-relevance< 2.19.5-r18
opensearch-dashboards-2-fips-dashboards-visualizations< 2.19.5-r18
opensearch-dashboards-2-fips-index-management-dashboards-plugin< 2.19.5-r18
opensearch-dashboards-2-fips-ml-commons-dashboards< 2.19.5-r18
opensearch-dashboards-2-fips-security-analytics-dashboards-plugin< 2.19.5-r18
opensearch-dashboards-2-fips-security-dashboards-plugin< 2.19.5-r18
opensearch-dashboards-3< 3.7.0-r7
opensearch-dashboards-3-alerting-dashboards-plugin< 3.7.0-r7
opensearch-dashboards-3-anomaly-detection-dashboards-plugin< 3.7.0-r7
opensearch-dashboards-3-dashboards-maps< 3.7.0-r7
opensearch-dashboards-3-dashboards-notifications< 3.7.0-r7
opensearch-dashboards-3-dashboards-observability< 3.7.0-r7
opensearch-dashboards-3-dashboards-query-workbench< 3.7.0-r7
opensearch-dashboards-3-dashboards-reporting< 3.7.0-r7
opensearch-dashboards-3-dashboards-search-relevance< 3.7.0-r7
opensearch-dashboards-3-fips< 3.7.0-r7
opensearch-dashboards-3-fips-alerting-dashboards-plugin< 3.7.0-r7
opensearch-dashboards-3-fips-anomaly-detection-dashboards-plugin< 3.7.0-r7
opensearch-dashboards-3-fips-dashboards-maps< 3.7.0-r7
opensearch-dashboards-3-fips-dashboards-notifications< 3.7.0-r7
opensearch-dashboards-3-fips-dashboards-observability< 3.7.0-r7
opensearch-dashboards-3-fips-dashboards-query-workbench< 3.7.0-r7
opensearch-dashboards-3-fips-dashboards-reporting< 3.7.0-r7
opensearch-dashboards-3-fips-dashboards-search-relevance< 3.7.0-r7
opensearch-dashboards-3-fips-index-management-dashboards-plugin< 3.7.0-r7
opensearch-dashboards-3-fips-ml-commons-dashboards< 3.7.0-r7
opensearch-dashboards-3-fips-security-analytics-dashboards-plugin< 3.7.0-r7
opensearch-dashboards-3-fips-security-dashboards-plugin< 3.7.0-r7
opensearch-dashboards-3-index-management-dashboards-plugin< 3.7.0-r7
opensearch-dashboards-3-ml-commons-dashboards< 3.7.0-r7
opensearch-dashboards-3-security-analytics-dashboards-plugin< 3.7.0-r7
opensearch-dashboards-3-security-dashboards-plugin< 3.7.0-r7
tensorflow-gpu-jupyter< 2.21.0-r12
wazuh-dashboard< 4.14.7-r2
wazuh-dashboard-alerting-dashboards-plugin< 4.14.7-r2
wazuh-dashboard-alerting-dashboards-plugin-fips< 4.14.7-r2
wazuh-dashboard-anomaly-detection-dashboards-plugin< 4.14.7-r2
wazuh-dashboard-anomaly-detection-dashboards-plugin-fips< 4.14.7-r2
wazuh-dashboard-dashboards-maps< 4.14.7-r2
wazuh-dashboard-dashboards-maps-fips< 4.14.7-r2
wazuh-dashboard-dashboards-notifications< 4.14.7-r2
wazuh-dashboard-dashboards-notifications-fips< 4.14.7-r2
wazuh-dashboard-dashboards-reporting< 4.14.7-r2
wazuh-dashboard-dashboards-reporting-fips< 4.14.7-r2
wazuh-dashboard-dashboards-visualizations< 4.14.7-r2
wazuh-dashboard-dashboards-visualizations-fips< 4.14.7-r2
wazuh-dashboard-fips< 4.14.7-r2
wazuh-dashboard-index-management-dashboards-plugin< 4.14.7-r2
wazuh-dashboard-index-management-dashboards-plugin-fips< 4.14.7-r2
wazuh-dashboard-plugins< 4.14.7-r2
wazuh-dashboard-plugins-fips< 4.14.7-r2
wazuh-dashboard-security-plugin< 4.14.7-r2
wazuh-dashboard-security-plugin-fips< 4.14.7-r2

Show all 101

Wolfi17 products

jupyter-base-notebook< 7.6.3-r2
langfuse-3-compat< 3.225.7-r6
langfuse-3-worker< 3.224.1-r0
nextcloud-server-33< 33.0.7-r5
opensearch-dashboards-3< 3.7.0-r7

Show all 17

Cure531 product

dompurify< 3.4.12

Debian1 product

node-dompurifyAll versions (No fix recorded) | < 3.4.12+dfsg-1

Npm1 product

dompurify< 3.4.12

Ubuntu1 product

node-dompurifyAll versions (No fix recorded)

6 vendors · 122 products

References

11 links

github.com/cure53/DOMPurify/security/advisories/GHSA-c2j3-45gr-mqc4Vendor AdvisoryREPORTWEBAdvisoryExploit
www.vulncheck.com/advisories/dompurify-before-hook-bypass-via-custom-element-handlingThird Party AdvisoryREPORTWEBAdvisory
ubuntu.com/security/CVE-2026-66010REPORT
www.cve.org/CVERecord?id=CVE-2026-66010REPORT
security-tracker.debian.org/tracker/CVE-2026-66010Advisory
github.com/cure53/DOMPurify/pull/1537WEB
github.com/cure53/DOMPurify/commit/a9ca1e537422319a557a9a2aa61f003b23b4a197WEB
github.com/cure53/DOMPurifyPACKAGE
github.com/cure53/DOMPurify/releases/tag/3.4.12WEB
nvd.nist.gov/vuln/detail/CVE-2026-66010Advisory

Show all 11 references

github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66010.jsonAdvisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities