Skip to content

ibmdotcom-utilities-2.54.0.tgz: 36 vulnerabilities (highest severity is: 9.3) - autoclosed #12616

Description

@ibm-mend-app
Vulnerable Library - ibmdotcom-utilities-2.54.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Vulnerabilities

Vulnerability Severity CVSS Dependency Type Fixed in (ibmdotcom-utilities version) Remediation Possible**
CVE-2026-49978 Critical 9.3 dompurify-3.3.1.tgz Transitive N/A*
CVE-2026-46625 High 7.5 js-cookie-2.2.1.tgz Transitive N/A*
CVE-2026-2229 High 7.5 undici-7.21.0.tgz Transitive N/A*
CVE-2026-1526 High 7.5 undici-7.21.0.tgz Transitive N/A*
CVE-2026-12151 High 7.5 undici-7.21.0.tgz Transitive N/A*
CVE-2026-13697 High 7.4 undici-7.21.0.tgz Transitive N/A*
CVE-2026-65898 High 7.2 dompurify-3.3.1.tgz Transitive N/A*
CVE-2026-41238 Medium 6.9 dompurify-3.3.1.tgz Transitive N/A*
CVE-2026-41239 Medium 6.8 dompurify-3.3.1.tgz Transitive N/A*
CVE-2026-41240 Medium 6.5 dompurify-3.3.1.tgz Transitive N/A*
CVE-2026-1525 Medium 6.5 undici-7.21.0.tgz Transitive N/A*
CVE-2026-66010 Medium 6.1 dompurify-3.3.1.tgz Transitive N/A*
CVE-2026-65914 Medium 6.1 dompurify-3.3.1.tgz Transitive N/A*
CVE-2026-65913 Medium 6.1 dompurify-3.3.1.tgz Transitive N/A*
CVE-2026-65912 Medium 6.1 dompurify-3.3.1.tgz Transitive N/A*
CVE-2026-65911 Medium 6.1 dompurify-3.3.1.tgz Transitive N/A*
CVE-2026-65903 Medium 6.1 dompurify-3.3.1.tgz Transitive N/A*
CVE-2026-65902 Medium 6.1 dompurify-3.3.1.tgz Transitive N/A*
CVE-2026-65901 Medium 6.1 dompurify-3.3.1.tgz Transitive N/A*
CVE-2026-65900 Medium 6.1 dompurify-3.3.1.tgz Transitive N/A*
CVE-2026-65899 Medium 6.1 dompurify-3.3.1.tgz Transitive N/A*
CVE-2026-49459 Medium 6.1 dompurify-3.3.1.tgz Transitive N/A*
CVE-2026-49458 Medium 6.1 dompurify-3.3.1.tgz Transitive N/A*
CVE-2026-0540 Medium 6.1 dompurify-3.3.1.tgz Transitive N/A*
CVE-2026-9679 Medium 5.9 undici-7.21.0.tgz Transitive N/A*
CVE-2026-9678 Medium 5.9 undici-7.21.0.tgz Transitive N/A*
CVE-2026-2581 Medium 5.9 undici-7.21.0.tgz Transitive N/A*
CVE-2026-14643 Medium 5.9 undici-7.21.0.tgz Transitive N/A*
CVE-2026-75838 Medium 5.4 dompurify-3.3.1.tgz Transitive N/A*
CVE-2026-16729 Medium 4.8 undici-7.21.0.tgz Transitive N/A*
CVE-2026-16728 Medium 4.8 undici-7.21.0.tgz Transitive N/A*
CVE-2026-65904 Medium 4.7 dompurify-3.3.1.tgz Transitive N/A*
CVE-2026-1527 Medium 4.6 undici-7.21.0.tgz Transitive N/A*
CVE-2026-15157 Medium 4.2 undici-7.21.0.tgz Transitive N/A*
CVE-2026-6733 Low 3.7 undici-7.21.0.tgz Transitive N/A*
CVE-2026-11525 Low 3.7 undici-7.21.0.tgz Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

Partial details (18 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2026-49978

Vulnerable Library - dompurify-3.3.1.tgz

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin

Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip

Dependency Hierarchy:

  • ibmdotcom-utilities-2.54.0.tgz (Root Library)
    • isomorphic-dompurify-2.36.0.tgz
      • dompurify-3.3.1.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside .content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7.

Publish Date: 2026-07-14

URL: CVE-2026-49978

CVSS 3 Score Details (9.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: cure53/DOMPurify@ca30f07

Release Date: 2026-06-15

Fix Resolution: https://github.com/cure53/DOMPurify.git - 3.4.7

CVE-2026-46625

Vulnerable Library - js-cookie-2.2.1.tgz

A simple, lightweight JavaScript API for handling cookies

Library home page: https://registry.npmjs.org/js-cookie/-/js-cookie-2.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/js-cookie-npm-2.2.1-e879cd2148-4387f5f569.zip

Dependency Hierarchy:

  • ibmdotcom-utilities-2.54.0.tgz (Root Library)
    • js-cookie-2.2.1.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "proto" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.proto setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for...in, every key the attacker placed on the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were locked down. This issue has been patched in version 3.0.7.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026-06-10

URL: CVE-2026-46625

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qjx8-664m-686j

Release Date: 2026-05-23

Fix Resolution: js-cookie - 3.0.7,https://github.com/js-cookie/js-cookie.git - v3.0.7

CVE-2026-2229

Vulnerable Library - undici-7.21.0.tgz

An HTTP/1.1 client, written from scratch for Node.js

Library home page: https://registry.npmjs.org/undici/-/undici-7.21.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/undici-npm-7.21.0-babfc213f0-2025ba33bd.zip

Dependency Hierarchy:

  • ibmdotcom-utilities-2.54.0.tgz (Root Library)
    • isomorphic-dompurify-2.36.0.tgz
      • jsdom-28.0.0.tgz
        • undici-7.21.0.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.
The vulnerability exists because:

  • The isValidClientWindowBits() function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15
  • The createInflateRaw() call is not wrapped in a try-catch block
  • The resulting exception propagates up through the call stack and crashes the Node.js process

Publish Date: 2026-03-12

URL: CVE-2026-2229

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-v9p9-hfj2-hcw8

Release Date: 2026-03-12

Fix Resolution: undici - 6.24.0,undici - 7.24.0

CVE-2026-1526

Vulnerable Library - undici-7.21.0.tgz

An HTTP/1.1 client, written from scratch for Node.js

Library home page: https://registry.npmjs.org/undici/-/undici-7.21.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/undici-npm-7.21.0-babfc213f0-2025ba33bd.zip

Dependency Hierarchy:

  • ibmdotcom-utilities-2.54.0.tgz (Root Library)
    • isomorphic-dompurify-2.36.0.tgz
      • jsdom-28.0.0.tgz
        • undici-7.21.0.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive.
The vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold.

Publish Date: 2026-03-12

URL: CVE-2026-1526

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-vrm6-8vpv-qv8q

Release Date: 2026-03-12

Fix Resolution: undici - 7.24.0,undici - 6.24.0

CVE-2026-12151

Vulnerable Library - undici-7.21.0.tgz

An HTTP/1.1 client, written from scratch for Node.js

Library home page: https://registry.npmjs.org/undici/-/undici-7.21.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/undici-npm-7.21.0-babfc213f0-2025ba33bd.zip

Dependency Hierarchy:

  • ibmdotcom-utilities-2.54.0.tgz (Root Library)
    • isomorphic-dompurify-2.36.0.tgz
      • jsdom-28.0.0.tgz
        • undici-7.21.0.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

Impact:
The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.
Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.
All releases starting at undici 6.17.0 are affected.
Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds:
No workaround is available. The fix must be applied through an upgrade.

Publish Date: 2026-06-17

URL: CVE-2026-12151

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-vxpw-j846-p89q

Release Date: 2026-06-17

Fix Resolution: undici - 8.5.0,undici - 6.27.0,undici - 7.28.0,https://github.com/nodejs/undici.git - v7.28.0,https://github.com/nodejs/undici.git - v6.27.0,https://github.com/nodejs/undici.git - v8.5.0

CVE-2026-13697

Vulnerable Library - undici-7.21.0.tgz

An HTTP/1.1 client, written from scratch for Node.js

Library home page: https://registry.npmjs.org/undici/-/undici-7.21.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/undici-npm-7.21.0-babfc213f0-2025ba33bd.zip

Dependency Hierarchy:

  • ibmdotcom-utilities-2.54.0.tgz (Root Library)
    • isomorphic-dompurify-2.36.0.tgz
      • jsdom-28.0.0.tgz
        • undici-7.21.0.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.

Publish Date: 2026-07-29

URL: CVE-2026-13697

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-4cwx-7wf7-3272

Release Date: 2026-07-29

Fix Resolution: undici - 7.29.0,undici - 8.9.0,https://github.com/nodejs/undici.git - v8.9.0,https://github.com/nodejs/undici.git - v7.29.0

CVE-2026-65898

Vulnerable Library - dompurify-3.3.1.tgz

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin

Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip

Dependency Hierarchy:

  • ibmdotcom-utilities-2.54.0.tgz (Root Library)
    • isomorphic-dompurify-2.36.0.tgz
      • dompurify-3.3.1.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.

Publish Date: 2026-07-23

URL: CVE-2026-65898

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: cure53/DOMPurify@0cae518

Release Date: 2026-07-23

Fix Resolution: dompurify - 3.4.11,https://github.com/cure53/DOMPurify.git - 3.4.11

CVE-2026-41238

Vulnerable Library - dompurify-3.3.1.tgz

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin

Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip

Dependency Hierarchy:

  • ibmdotcom-utilities-2.54.0.tgz (Root Library)
    • isomorphic-dompurify-2.36.0.tgz
      • dompurify-3.3.1.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

Summary DOMPurify versions 3.0.1 through 3.3.3 (latest) are vulnerable to a prototype pollution-based XSS bypass. When an application uses "DOMPurify.sanitize()" with the default configuration (no "CUSTOM_ELEMENT_HANDLING" option), a prior prototype pollution gadget can inject permissive "tagNameCheck" and "attributeNameCheck" regex values into "Object.prototype", causing DOMPurify to allow arbitrary custom elements with arbitrary attributes — including event handlers — through sanitization. Affected Versions - 3.0.1 through 3.3.3 (current latest) — all affected - 3.0.0 and all 2.x versions — NOT affected (used "Object.create(null)" for initialization, no "|| {}" reassignment) - The vulnerable "|| {}" reassignment was introduced in the 3.0.0→3.0.1 refactor - This is distinct from GHSA-cj63-jhhr-wcxv (USE_PROFILES Array.prototype pollution, fixed in 3.3.2) - This is distinct from CVE-2024-45801 / GHSA-mmhx-hmjr-r674 (__depth prototype pollution, fixed in 3.1.3) Root Cause In "purify.js" at line 590, during config parsing: CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {}; When no "CUSTOM_ELEMENT_HANDLING" is specified in the config (the default usage pattern), "cfg.CUSTOM_ELEMENT_HANDLING" is "undefined", and the fallback "{}" is used. This plain object inherits from "Object.prototype". Lines 591-598 then check "cfg.CUSTOM_ELEMENT_HANDLING" (the original config property) — which is "undefined" — so the conditional blocks that would set "tagNameCheck" and "attributeNameCheck" from the config are never entered. As a result, "CUSTOM_ELEMENT_HANDLING.tagNameCheck" and "CUSTOM_ELEMENT_HANDLING.attributeNameCheck" resolve via the prototype chain. If an attacker has polluted "Object.prototype.tagNameCheck" and "Object.prototype.attributeNameCheck" with permissive values (e.g., "/.*/"), these polluted values flow into DOMPurify's custom element validation at lines 973-977 and attribute validation, causing all custom elements and all attributes to be allowed. Impact - Attack type: XSS bypass via prototype pollution chain - Prerequisites: Attacker must have a prototype pollution primitive in the same execution context (e.g., vulnerable version of lodash, jQuery.extend, query-string parser, deep merge utility, or any other PP gadget) - Config required: Default. No special DOMPurify configuration needed. The standard "DOMPurify.sanitize(userInput)" call is affected. - Payload: Any HTML custom element (name containing a hyphen) with event handler attributes survives sanitization.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026-04-23

URL: CVE-2026-41238

CVSS 3 Score Details (6.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-v9jr-rg53-9pgp

Release Date: 2026-04-22

Fix Resolution: dompurify - 3.4.0,dompurify - 3.4.0

CVE-2026-41239

Vulnerable Library - dompurify-3.3.1.tgz

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin

Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip

Dependency Hierarchy:

  • ibmdotcom-utilities-2.54.0.tgz (Root Library)
    • isomorphic-dompurify-2.36.0.tgz
      • dompurify-3.3.1.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

Summary | Field | Value | |:------|:------| | Severity | Medium | | Affected | DOMPurify "main" at ""883ac15"" (https://github.com/cure53/DOMPurify/tree/883ac15d47f907cb1a3b5a152fe90c4d8c10f9e6), introduced in v1.0.10 (""7fc196db"" (cure53/DOMPurify@7fc196d)) | "SAFE_FOR_TEMPLATES" strips "{{...}}" expressions from untrusted HTML. This works in string mode but not with "RETURN_DOM" or "RETURN_DOM_FRAGMENT", allowing XSS via template-evaluating frameworks like Vue 2. Technical Details DOMPurify strips template expressions in two passes: 1. Per-node — each text node is checked during the tree walk (""purify.ts:1179-1191"" (https://github.com/cure53/DOMPurify/blob/883ac15d47f907cb1a3b5a152fe90c4d8c10f9e6/src/purify.ts#L1179-L1191)): // pass #⁠1: runs on every text node during tree walk if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) { content = currentNode.textContent; content = content.replace(MUSTACHE_EXPR, ' '); // {{...}} -> ' ' content = content.replace(ERB_EXPR, ' '); // <%...%> -> ' ' content = content.replace(TMPLIT_EXPR, ' '); // ${... -> ' ' currentNode.textContent = content; } 2. Final string scrub — after serialization, the full HTML string is scrubbed again (""purify.ts:1679-1683"" (https://github.com/cure53/DOMPurify/blob/883ac15d47f907cb1a3b5a152fe90c4d8c10f9e6/src/purify.ts#L1679-L1683)). This is the safety net that catches expressions that only form after the DOM settles. The "RETURN_DOM" path returns before pass #⁠2 ever runs (""purify.ts:1637-1661"" (https://github.com/cure53/DOMPurify/blob/883ac15d47f907cb1a3b5a152fe90c4d8c10f9e6/src/purify.ts#L1637-L1661)): // purify.ts (simplified) if (RETURN_DOM) { // ... build returnNode ... return returnNode; // <-- exits here, pass #⁠2 never runs } // pass #⁠2: only reached by string-mode callers if (SAFE_FOR_TEMPLATES) { serializedHTML = serializedHTML.replace(MUSTACHE_EXPR, ' '); } return serializedHTML; The payload "{{constructor.constructor('alert(1)')()}}" exploits this: 3. Parser creates: "TEXT("{")" → "" → "TEXT("{payload}")" → "" → "TEXT("}")" — no single node contains "{{", so pass #⁠1 misses it 4. "" is not allowed, so DOMPurify removes it but keeps surrounding text 5. The three text nodes are now adjacent — ".outerHTML" reads them as "{{payload}}", which Vue 2 compiles and executes
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026-04-23

URL: CVE-2026-41239

CVSS 3 Score Details (6.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-crv5-9vww-q3g8

Release Date: 2026-04-22

Fix Resolution: dompurify - 3.4.0,dompurify - 3.4.0

CVE-2026-41240

Vulnerable Library - dompurify-3.3.1.tgz

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin

Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip

Dependency Hierarchy:

  • ibmdotcom-utilities-2.54.0.tgz (Root Library)
    • isomorphic-dompurify-2.36.0.tgz
      • dompurify-3.3.1.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

There is an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit "c361baa" (cure53/DOMPurify@c361baa) added an early exit for FORBID_ATTR at line 1214: /* FORBID_ATTR must always win, even if ADD_ATTR predicate would allow it / if (FORBID_ATTR[lcName]) { return false; } The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely: if ( !( EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName) // true -> short-circuits ) && (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) // never evaluated ) { This allows forbidden elements to survive sanitization with their attributes intact.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026-04-23

URL: CVE-2026-41240

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-h7mw-gpvr-xq4m

Release Date: 2026-04-23

Fix Resolution: dompurify - 3.4.0,dompurify - 3.4.0

CVE-2026-1525

Vulnerable Library - undici-7.21.0.tgz

An HTTP/1.1 client, written from scratch for Node.js

Library home page: https://registry.npmjs.org/undici/-/undici-7.21.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/undici-npm-7.21.0-babfc213f0-2025ba33bd.zip

Dependency Hierarchy:

  • ibmdotcom-utilities-2.54.0.tgz (Root Library)
    • isomorphic-dompurify-2.36.0.tgz
      • jsdom-28.0.0.tgz
        • undici-7.21.0.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.
Who is impacted:

  • Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays
  • Applications that accept user-controlled header names without case-normalization
    Potential consequences:
  • Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)
  • HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking

Publish Date: 2026-03-12

URL: CVE-2026-1525

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-2mjp-6q6p-2qxm

Release Date: 2026-03-12

Fix Resolution: undici - 6.24.0,undici - 7.24.0

CVE-2026-66010

Vulnerable Library - dompurify-3.3.1.tgz

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin

Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip

Dependency Hierarchy:

  • ibmdotcom-utilities-2.54.0.tgz (Root Library)
    • isomorphic-dompurify-2.36.0.tgz
      • dompurify-3.3.1.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into innerHTML sinks, creating second-order XSS gadgets.

Publish Date: 2026-07-24

URL: CVE-2026-66010

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2j3-45gr-mqc4

Release Date: 2026-07-24

Fix Resolution: dompurify - 3.4.12,dompurify - 3.4.12,https://github.com/cure53/DOMPurify.git - 3.4.12

CVE-2026-65914

Vulnerable Library - dompurify-3.3.1.tgz

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin

Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip

Dependency Hierarchy:

  • ibmdotcom-utilities-2.54.0.tgz (Root Library)
    • isomorphic-dompurify-2.36.0.tgz
      • dompurify-3.3.1.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper context during reparsing, reactivating dangerous markup with event handlers to execute JavaScript.

Publish Date: 2026-07-23

URL: CVE-2026-65914

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: cure53/DOMPurify@5cad4ce

Release Date: 2026-07-23

Fix Resolution: dompurify - 3.3.2,https://github.com/cure53/DOMPurify.git - 3.3.2

CVE-2026-65913

Vulnerable Library - dompurify-3.3.1.tgz

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin

Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip

Dependency Hierarchy:

  • ibmdotcom-utilities-2.54.0.tgz (Root Library)
    • isomorphic-dompurify-2.36.0.tgz
      • dompurify-3.3.1.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.

Publish Date: 2026-07-23

URL: CVE-2026-65913

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: cure53/DOMPurify@5cad4ce

Release Date: 2026-07-23

Fix Resolution: dompurify - 3.3.2,https://github.com/cure53/DOMPurify.git - 3.3.2

CVE-2026-65912

Vulnerable Library - dompurify-3.3.1.tgz

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin

Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip

Dependency Hierarchy:

  • ibmdotcom-utilities-2.54.0.tgz (Root Library)
    • isomorphic-dompurify-2.36.0.tgz
      • dompurify-3.3.1.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe protocols like javascript: to survive sanitization and execute as DOM-based XSS when the link is activated.

Publish Date: 2026-07-23

URL: CVE-2026-65912

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: cure53/DOMPurify@5cad4ce

Release Date: 2026-07-23

Fix Resolution: dompurify - 3.3.2,https://github.com/cure53/DOMPurify.git - 3.3.2

CVE-2026-65911

Vulnerable Library - dompurify-3.3.1.tgz

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin

Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip

Dependency Hierarchy:

  • ibmdotcom-utilities-2.54.0.tgz (Root Library)
    • isomorphic-dompurify-2.36.0.tgz
      • dompurify-3.3.1.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can allow dangerous event-handler attributes or forbidden tags (bypassing FORBID_TAGS) to survive sanitization, resulting in cross-site scripting. The vendor (Cure53) considers this an edge case outside DOMPurify's threat model; the referenced advisory lists 3.4.0 as the patched version.

Publish Date: 2026-07-23

URL: CVE-2026-65911

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: cure53/DOMPurify@5b16e0b

Release Date: 2026-07-23

Fix Resolution: dompurify - 3.4.0,https://github.com/cure53/DOMPurify.git - 3.4.0

CVE-2026-65903

Vulnerable Library - dompurify-3.3.1.tgz

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin

Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip

Dependency Hierarchy:

  • ibmdotcom-utilities-2.54.0.tgz (Root Library)
    • isomorphic-dompurify-2.36.0.tgz
      • dompurify-3.3.1.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.

Publish Date: 2026-07-23

URL: CVE-2026-65903

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: cure53/DOMPurify@5b16e0b

Release Date: 2026-07-23

Fix Resolution: dompurify - 3.4.0,https://github.com/cure53/DOMPurify.git - 3.4.0

CVE-2026-65902

Vulnerable Library - dompurify-3.3.1.tgz

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin

Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip

Dependency Hierarchy:

  • ibmdotcom-utilities-2.54.0.tgz (Root Library)
    • isomorphic-dompurify-2.36.0.tgz
      • dompurify-3.3.1.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitize calls inherit the widened defaults and attacker payloads using the poisoned tag/attribute name survive sanitization. removeAllHooks(), clearConfig(), and passing a fresh cfg do not recover the state; only constructing a new DOMPurify instance does.

Publish Date: 2026-07-23

URL: CVE-2026-65902

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: cure53/DOMPurify@ca30f07

Release Date: 2026-07-23

Fix Resolution: dompurify - 3.4.7,https://github.com/cure53/DOMPurify.git - 3.4.7

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    Status
    Done

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions