https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T11:14:13.224038+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-0540 CVE-2026-0540 — DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML 2026-09-28T11:14:13.474253+00:00

Affected: cure53 DOMPurify

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.