CVE-2025-26791: Cure53 DOMPurify mXSS Vulnerability

CVE-2025-26791 Overview

DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).

Critical Impact

This vulnerability allows attackers to conduct mXSS attacks, potentially compromising user data.

Affected Products

• Cure53 DOMPurify

Discovery Timeline

• Not Available - Vulnerability discovered by Not Available
• Not Available - Responsible disclosure to cure53
• Not Available - CVE CVE-2025-26791 assigned
• Not Available - cure53 releases security patch
• 2025-02-14T09:15:08.067 - CVE CVE-2025-26791 published to NVD
• 2025-10-07T20:56:12.317 - Last updated in NVD database

Technical Details for CVE-2025-26791

Vulnerability Analysis

The vulnerability is caused by improper regular expression handling in DOMPurify, which can lead to mutation XSS, a type of stored XSS attack vector.

Root Cause

The root cause is an incorrect template literal regular expression used in DOMPurify’s input sanitization process.

Attack Vector

Network-based attack vector allows remote attackers to exploit this vulnerability through crafted HTML content.

// Example exploitation code (sanitized)
var template = `<img src=x onerror=alert(1)>`;
DOMPurify.sanitize(template);

Detection Methods for CVE-2025-26791

Indicators of Compromise

• Presence of abnormal script tags in user inputs
• Unusual DOM mutations during DOMPurify execution
• Alerts triggered upon user input render

Detection Strategies

Network security tools can monitor HTTP requests for DOM-related anomalies and unexpected script tags.

Monitoring Recommendations

Utilize browser-based security tools to capture XSS patterns or anomalies during input processing.

How to Mitigate CVE-2025-26791

Immediate Actions Required

• Update DOMPurify to version 3.2.4
• Conduct manual code review to ensure no templates are misused
• Implement server-side input validation as a secondary control

Patch Information

A patch has been released by Cure53 resolving this issue:
DOMPurify Patch Commit

Workarounds

If patching is not immediately possible, employ strict CSP rules to mitigate risks.

# Example Content Security Policy
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline';