CVE-2026-0540
DOMPurify 3.1.3–3.3.1 (fixed 3.3.2)
- Class
- XSS
- Severity
- Medium · CVSS 4.0 score 5.3
- Disclosed
- Credit
- Co-discovered: Camilo Vera, Cristian Vargas (Fluid Attacks Offensive Team) and Scott Moore (VulnCheck)
- Code name
- daft
- Affected
- DOMPurify 3.1.3–3.3.1 (fixed 3.3.2)
The defect
DOM-based XSS (mXSS via re-contextualization)
Class overview · XSS
Attacker-controlled markup or a script context breaks out in the browser of whoever views the page. Consequences run from actions taken with the victim's privileges to full account takeover when the script runs in their session.