CVE-2025-26791

What it actually does

Incorrect regular expression handling of template literals in DOMPurify allows crafted input to bypass sanitization and trigger mutation XSS by altering the DOM structure after initial parsing.

Why it matters to the business

Applications relying on this library for content sanitization may allow malicious scripts to execute in users' browsers, leading to potential data theft, session hijacking, or unauthorized actions on behalf of users.

How an attack unfolds

An attacker supplies specially crafted HTML containing template literal syntax that evades the flawed regex check; after DOMPurify sanitizes and the browser mutates the content, the payload executes as JavaScript in the victim's context.

How to fix it

Upgrade cure53/dompurify to the commit d18ffcb554e0001748865da03ac75dd7829f0f02 or later release containing the corrected template literal regular expression; re-test all sanitization paths with known mXSS test vectors.

How to confirm the fix worked

Confirm the installed version is at or beyond the fixed commit, run the library's test suite including mXSS cases, and perform manual verification by feeding the original bypass payloads through the updated sanitizer.

Typical attack path

1. Identify a web application using a vulnerable DOMPurify version for sanitizing user-controlled or third-party content.
2. Craft malicious input using template literal syntax designed to survive the regex filter.
3. Submit the payload through an input field, API endpoint, or imported data source.
4. Trigger client-side rendering that invokes DOMPurify followed by DOM insertion.
5. Observe mutation that activates the embedded script and performs actions such as cookie exfiltration or form submission.

How to detect it

Review web application logs and browser telemetry for unexpected script execution or DOM changes following content sanitization; inspect network requests or storage access that originate from sanitized user content areas.

What your security team should do

• Immediately update all instances of DOMPurify to the fixed commit in development, staging, and production environments.
• Audit codebases for direct or transitive dependencies on older DOMPurify versions and enforce version pinning in package manifests.
• Add automated dependency scanning and alerts for future library updates.
• Review and expand input sanitization test coverage to include template literal and mutation scenarios.