Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2026-65914 - Vulnerability Database
DOMPurify

DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2026-65914

Medium
Reference: CVE-2026-65914
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-65914
Title: DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Overview:

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script xmp iframe noembed noframes or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper context during reparsing reactivating dangerous markup with event handlers to execute JavaScript.