CVE-2026-65914: 
JavaScript vulnerability analysis and mitigation

CVE-2026-65914 is a mutation Cross-Site Scripting (mXSS) vulnerability in DOMPurify, a widely-used HTML sanitization library maintained by cure53. The flaw affects DOMPurify versions before 3.3.2 and was discovered by Camilo Vera and Cristian Vargas of the Fluid Attacks Research Team, with the advisory published on July 23, 2026. The vulnerability arises when sanitized HTML is reinserted into special parsing contexts (e.g., script, xmp, iframe, noembed, noframes, or noscript wrappers) via innerHTML, allowing crafted payloads to reactivate dangerous markup and execute JavaScript. It carries a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Feedly).

The root cause is a parse-context mismatch (CWE-79): DOMPurify sanitizes input under standard HTML parsing rules (Parse 1), but when the sanitized output is concatenated into a raw-text wrapper element (e.g., <xmp>, <script>) and reinserted via innerHTML (Parse 2), the browser's parser interprets the content under different rules. Attacker-controlled closing sequences such as </script> or </xmp> embedded inside attribute values (e.g., <img src=x alt="</script><img src=x onerror=alert('expoc')>">) break out of the wrapper context during reparsing, reintroducing dangerous markup with event handlers outside the original attribute context. DOMPurify correctly sanitizes the first parse tree, but the application's second parse in a different context reactivates the malicious tokens — a classic mXSS pattern. A public PoC demonstrating alert() execution via the xmp wrapper is included in the GitHub advisory (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser context, enabling session hijacking, credential theft, DOM manipulation, and exfiltration of sensitive data accessible to the page. The vulnerability affects the integrity and confidentiality of subsequent systems (e.g., user sessions and data), though the vulnerable system itself (the sanitization library) has no direct confidentiality or availability impact. Because DOMPurify is a foundational library used across a broad range of web applications, the blast radius can be significant wherever applications reinsert sanitized output into raw-text wrapper elements (GitHub Advisory, Feedly).

1. Identify a vulnerable target: Find a web application that uses DOMPurify < 3.3.2 for server-side or client-side sanitization and subsequently reinserts the sanitized output into a raw-text wrapper element (e.g., <xmp>, <script>, <noscript>, <iframe>, <noembed>, <noframes>) via innerHTML.
2. Craft the mXSS payload: Construct an HTML payload that appears benign after DOMPurify sanitization but contains a closing sequence for the target wrapper inside an attribute value. Example payload: <img src=x alt="</xmp><img src=x onerror=alert('expoc')"> (adjust closing tag to match the target wrapper).
3. Submit the payload: Deliver the crafted input to the application's sanitization endpoint (e.g., via a form field, URL parameter, or API request that accepts user-supplied HTML).
4. Trigger re-contextualization: The application concatenates the sanitized output into a wrapper string and assigns it to innerHTML: sink.innerHTML = '<xmp>' + sanitized + '</xmp>';. During this second parse, the browser's raw-text parser interprets </xmp> as closing the wrapper, causing the subsequent <img onerror=...> to be parsed as live HTML.
5. Achieve JavaScript execution: The event handler (e.g., onerror) fires in the victim's browser, executing attacker-controlled JavaScript. This can be used to steal cookies, exfiltrate tokens, perform actions on behalf of the user, or redirect to attacker-controlled infrastructure (GitHub Advisory).

• Network: HTTP requests containing encoded or raw closing sequences for raw-text HTML elements (e.g., </xmp>, </script>, </noscript>) embedded within attribute values in user-supplied input fields; unexpected outbound connections from the browser to attacker-controlled domains following page load.
• Logs: Application or WAF logs showing input containing patterns like </xmp>, </noembed>, </noframes>, </noscript>, or </iframe> inside HTML attribute values (e.g., alt="</xmp>..."); repeated sanitization requests with structurally unusual payloads.
• Browser/Client-Side: Unexpected JavaScript execution (e.g., alert() dialogs, console errors) on pages that render user-supplied content; DOM inspection revealing <img onerror=...> or similar event-handler elements outside expected wrapper boundaries.

Upgrade DOMPurify to version 3.3.2 or later, which is the patched release that addresses this vulnerability. As a workaround where upgrading is not immediately possible, avoid concatenating sanitized HTML strings into raw-text wrapper elements (xmp, script, noscript, iframe, noembed, noframes) before assigning to innerHTML; instead, use DOM-safe APIs such as textContent, createElement, and setAttribute. Ensure that sanitization occurs as close as possible to the final rendering context, and add regression tests for context-switch/mXSS payloads to prevent reintroduction (GitHub Advisory).

The vulnerability was responsibly disclosed by Camilo Vera and Cristian Vargas of the Fluid Attacks Research Team, who credited Oscar Uribe as the reporting coordinator. The cure53 team published the GitHub Security Advisory (GHSA-h8r8-wccr-v5f2) and released the patched version 3.3.2. The advisory includes detailed remediation guidance emphasizing that sanitization is not a universal guarantee across all future parsing contexts, a nuance that is broadly relevant to the web security community. No significant broader media coverage or social media reactions have been identified at this time (GitHub Advisory).