CVE-2026-65914

A flaw was found in DOMPurify. This vulnerability, a type of Cross-Site Scripting (XSS), occurs when HTML that has been sanitized is reinserted into specific parsing contexts using innerHTML with certain HTML elements like script or iframe. An attacker can craft malicious input that, during re-parsing, can bypass the sanitization and execute arbitrary JavaScript code in the user's browser.

This Moderate-impact mutation-XSS vulnerability in DOMPurify allows for arbitrary code execution when sanitized HTML is reinserted into specific parsing contexts. However, Red Hat Hardened Images are not affected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.