CVE-2025-15599: 
JavaScript vulnerability analysis and mitigation

CVE-2025-15599 is a cross-site scripting (XSS) vulnerability in DOMPurify, a widely used JavaScript HTML sanitization library. It affects DOMPurify versions 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8, and allows attackers to bypass attribute sanitization by exploiting missing rawtext element validation in the SAFE_FOR_XML regex. The vulnerability was disclosed on March 3, 2026, with a fix released for the 3.x branch in version 3.2.7; the 2.x branch was never patched. It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The SAFE_FOR_XML regex in DOMPurify failed to account for all rawtext HTML elements (e.g., <textarea>, <noscript>, <iframe>, <noembed>, <noframes>, <xmp>) when validating attribute values. An attacker can craft an attribute value containing a closing rawtext tag such as </textarea>, which causes the browser to interpret the sanitized output as breaking out of the rawtext context when it is subsequently inserted into a rawtext element by the application. The fix (commit c861f5a) expanded the regex from /((--!?|])>)|</(style|title|textarea)/i to include the full set of rawtext elements: /((--!?|])>)|</(style|title|xmp|textarea|noscript|iframe|noembed|noframes)/i (DOMPurify Commit).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session when sanitized output is placed inside rawtext HTML elements such as <textarea>. This can lead to session hijacking, credential theft, unauthorized actions on behalf of the user, and data exfiltration — all within the scope of the affected web application. The attack requires user interaction (e.g., visiting a crafted page) but requires no authentication or special privileges, and the scope is changed, meaning the impact can extend beyond the vulnerable component (Red Hat Advisory, Red Hat Bugzilla).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat Advisory). The EPSS score is approximately 0.029% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction and is contingent on the application inserting DOMPurify-sanitized output into rawtext HTML elements, which limits the attack surface to specific usage patterns.

1. Identify a target application: Find a web application that uses a vulnerable version of DOMPurify (3.1.3–3.2.6 or 2.5.3–2.5.8) with the SAFE_FOR_XML option enabled, and that inserts sanitized user-controlled output into a rawtext HTML element such as <textarea>.
2. Craft a malicious payload: Construct an HTML attribute value containing a closing rawtext tag, for example: <input value="</textarea><script>alert(document.cookie)</script>">. DOMPurify's incomplete regex will not strip this attribute value because it does not recognize </textarea> as dangerous in this context.
3. Submit the payload: Inject the crafted input through any user-controlled field that is sanitized by DOMPurify and subsequently rendered inside a <textarea> or similar rawtext element in the page.
4. Trigger execution: When a victim user views the page containing the sanitized-but-malicious output, the browser interprets the </textarea> tag as closing the rawtext context, causing the subsequent <script> block to be parsed and executed as JavaScript.
5. Achieve objective: The executed JavaScript runs in the victim's browser session, enabling session token theft, phishing overlays, keylogging, or other client-side attacks (DOMPurify Commit, Red Hat Bugzilla).

• Network: Unusual outbound requests from client browsers to attacker-controlled domains following interaction with pages that render user-supplied content inside <textarea> or similar rawtext elements.
• Logs: Web server or application logs showing submissions of attribute values containing patterns like </textarea>, </noscript>, </iframe>, </noembed>, </noframes>, or </xmp> in user-controlled input fields.
• Application Behavior: Reports of unexpected JavaScript execution or pop-ups on pages that use DOMPurify-sanitized content rendered inside rawtext HTML elements.
• Dependency Audit: Presence of DOMPurify versions 3.1.3–3.2.6 or 2.5.3–2.5.8 in package.json, package-lock.json, or node_modules directories.

For the 3.x branch, upgrade DOMPurify to version 3.2.7 or later, which expands the SAFE_FOR_XML regex to cover all rawtext elements. The 2.x branch (versions 2.5.3–2.5.8) has not been patched and users must migrate to the 3.x branch (3.2.7+). As a defense-in-depth measure, avoid inserting DOMPurify-sanitized output directly into rawtext HTML elements (e.g., <textarea>, <noscript>, <iframe>), and apply additional server-side input validation and output encoding. IBM has released patches for affected products including Carbon Charts, IBM API Connect, IBM QRadar, IBM Storage Defender, and IBM Business Automation Insights (DOMPurify Commit, IBM Carbon Charts Advisory).

IBM issued multiple security bulletins addressing CVE-2025-15599 across a broad range of products including Carbon Charts, IBM API Connect, IBM QRadar SIEM, IBM Storage Defender, IBM Business Automation Insights, and IBM DevOps Test UI, reflecting the wide adoption of DOMPurify in enterprise software (IBM Carbon Charts Advisory). Dell also issued an advisory (DSA-2026-207) for Dell SmartFabric Manager referencing this CVE. The vulnerability was assigned by VulnCheck and tracked by ENISA under EUVD-2025-208240. Community coverage was noted on security aggregation platforms including VulnDB, CVEFeed, and Vulners shortly after disclosure.