{"id":"EUVD-2025-208240","enisaUuid":"37ff1963-784b-3138-830f-fbbb69ec9b5f","description":"DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like \u003c/textarea\u003e in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.","datePublished":"Mar 3, 2026, 5:26:05 PM","dateUpdated":"Oct 8, 2026, 3:21:15 PM","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/cure53/DOMPurify\nhttps://github.com/cure53/DOMPurify/commit/c861f5a83fb8d90800f1680f855fee551161ac2b\nhttps://www.vulncheck.com/advisories/dompurify-xss-via-textarea-rawtext-bypass-in-safe-for-xml\n","aliases":"CVE-2025-15599\nGHSA-v8jm-5vwx-cfxm\n","assigner":"VulnCheck","epss":0.29,"enisaIdProduct":[{"id":"599578ff-3dd2-35b5-8c6c-430b380df5fd","product":{"name":"DOMPurify","vendor":{"name":"cure53"}},"product_version":"3.1.3 ≤3.2.6"},{"id":"d672ecd4-3e8f-34c4-a340-cc650ec891a7","product":{"name":"DOMPurify","vendor":{"name":"cure53"}},"product_version":"2.5.3 ≤2.5.8"}],"enisaIdVendor":[{"id":"13c40744-4498-3e0e-b0ed-6b947d2633de","vendor":{"name":"cure53"}}],"enisaIdVulnerability":[{"id":"2661e663-4b23-3171-a9f2-7c35d36bbabd","vulnerability":{"id":"GHSA-v8jm-5vwx-cfxm","description":"DOMPurify contains a Cross-site Scripting vulnerability","datePublished":"Mar 3, 2026, 6:31:33 PM","dateUpdated":"Mar 4, 2026, 8:50:09 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-15599\nhttps://github.com/cure53/DOMPurify/commit/c861f5a83fb8d90800f1680f855fee551161ac2b\nhttps://github.com/cure53/DOMPurify\nhttps://www.vulncheck.com/advisories/dompurify-xss-via-textarea-rawtext-bypass-in-safe-for-xml\nhttps://www.vulncheck.com/advisories/dompurify-xss-via-textarea-rawtext-bypass-in-safeforxml\n","enisa_id":"EUVD-2025-208240\n","aliases":"GHSA-v8jm-5vwx-cfxm\nCVE-2025-15599\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 1:55:52 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a1ae5e43-335d-33b0-a435-7f985365400e","vulnerability":{"id":"CVE-2025-15599","description":"DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like \u003c/textarea\u003e in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.","datePublished":"Mar 3, 2026, 5:26:05 PM","dateUpdated":"Oct 8, 2026, 3:21:15 PM","status":"PUBLISHED","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/cure53/DOMPurify\nhttps://github.com/cure53/DOMPurify/commit/c861f5a83fb8d90800f1680f855fee551161ac2b\nhttps://www.vulncheck.com/advisories/dompurify-xss-via-textarea-rawtext-bypass-in-safe-for-xml\n","enisa_id":"EUVD-2025-208240\n","assigner":"VulnCheck","epss":0.29,"dataProcessed":"Nov 8, 2026, 7:18:04 AM","vulnerabilityProduct":[{"id":"53e64dd2-2542-3560-99ef-85a5170544b5","product":{"name":"DOMPurify","vendor":{"name":"cure53"}},"product_version":"2.5.3 ≤2.5.8"},{"id":"91a54971-016f-3aed-a7e6-f80fe26b7117","product":{"name":"DOMPurify","vendor":{"name":"cure53"}},"product_version":"3.1.3 ≤3.2.6"}],"vulnerabilityVendor":[{"id":"8542eb96-8813-3f75-82e9-c8e4797326cc","vendor":{"name":"cure53"}}]}}],"enisaIdAdvisory":[{"id":"617011cb-b689-3fdf-96da-2ec15383a17f","advisory":{"id":"RHSA-2026:86618","description":"Red Hat Security Advisory: New container image: rhceph-9.2","summary":"A new version of Red Hat build of Ceph Storage has been released","datePublished":"Oct 21, 2026, 6:15:17 AM","dateUpdated":"Nov 8, 2026, 4:02:36 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:86618\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_86618.json\n","aliases":"CVE-2023-46159\nCVE-2024-47866\nCVE-2024-48916\nCVE-2024-55565\nCVE-2025-12816\nCVE-2025-15599\nCVE-2025-26791\nCVE-2025-30156\nCVE-2025-50181\nCVE-2025-50182\nCVE-2025-58754\nCVE-2025-59343\nCVE-2025-62718\nCVE-2025-66030\nCVE-2025-66035\nCVE-2025-66412\nCVE-2025-69873\nCVE-2026-0540\nCVE-2026-21441\nCVE-2026-22610\nCVE-2026-25639\nCVE-2026-26996\nCVE-2026-27903\nCVE-2026-27904\nCVE-2026-27970\nCVE-2026-32141\nCVE-2026-33228\nCVE-2026-33671\nCVE-2026-33672\nCVE-2026-33891\nCVE-2026-33894\nCVE-2026-33895\nCVE-2026-33896\nCVE-2026-39865\nCVE-2026-40175\nCVE-2026-40895\nCVE-2026-41238\nCVE-2026-41239\nCVE-2026-41240\nCVE-2026-41305\nCVE-2026-42033\nCVE-2026-42034\nCVE-2026-42035\nCVE-2026-42036\nCVE-2026-42037\nCVE-2026-42038\nCVE-2026-42039\nCVE-2026-42040\nCVE-2026-42041\nCVE-2026-42042\nCVE-2026-42043\nCVE-2026-42044\nCVE-2026-50152\nCVE-2026-58224\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"00235f61-fab3-373e-9125-2bd4e74dbcdb","product":{"name":"registry.redhat.io/rhceph/alloy-rhel10@sha256:c44c3c02709d9effcee15e4c444d0933e4dc92200126256bc436a91315d661ce_ppc64le","vendor":{"name":"Red Hat"}}},{"id":"05543bef-eb90-3d61-ad9a-f8d5513a0b36","product":{"name":"registry.redhat.io/rhceph/keepalived-rhel10@sha256:215b4d293664a13186f738a02307ad686ecd8c18e3154778cefc5cd48098244a_ppc64le","vendor":{"name":"Red Hat"}}},{"id":"062e9634-92cb-3ab0-813b-21574fb4b222","product":{"name":"registry.redhat.io/rhceph/rhceph-haproxy-rhel10@sha256:8cffd72b960f38ac68d645e4a9bebefb41ea6ec86f6eade0e31e94e54eff9518_ppc64le","vendor":{"name":"Red Hat"}}},{"id":"115b2121-e505-3a07-8517-7ca8204a71cf","product":{"name":"registry.redhat.io/rhceph/alloy-rhel10@sha256:418bfcb3127da79a33297b2d48718b1de233c833fe9e4f0bf135974d254ad417_s390x","vendor":{"name":"Red Hat"}}},{"id":"165ad424-0b0d-3b4d-99cc-752b12ee94bd","product":{"name":"registry.redhat.io/rhceph/grafana-rhel10@sha256:d5ecc8340af5598131845db29148b24b4a6da344ae9831c7ffd10a2847000208_arm64","vendor":{"name":"Red Hat"}}},{"id":"17ce7fc8-8921-363d-b5c1-faf2eec970da","product":{"name":"registry.redhat.io/rhceph/oauth2-proxy-rhel10@sha256:6028e75c091f45e699c18817ab387fc267566c3a99f35cbc16dd6678eca52b04_amd64","vendor":{"name":"Red Hat"}}},{"id":"1a6b6f51-8d08-3e05-8e38-47276b79c008","product":{"name":"registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:f1b9bb921dd0c71c7c30b5880e9d15ac1f11be1fa1d6fccd8a4728a4df2369be_ppc64le","vendor":{"name":"Red Hat"}}},{"id":"220e7b29-d390-3d75-82bb-e7eed61339c2","product":{"name":"registry.redhat.io/rhceph/keepalived-rhel10@sha256:41eb459a0560110c950039d3ea5b34e235d05a06dd4c2f2da7ef14fecc641bdc_s390x","vendor":{"name":"Red Hat"}}},{"id":"27a3978e-81d7-3392-b333-816ecc8ee455","product":{"name":"registry.redhat.io/rhceph/oauth2-proxy-rhel10@sha256:7ffce56beb357c70924100d89b078786229036577b3fc5682fc9ffe937f9d011_arm64","vendor":{"name":"Red Hat"}}},{"id":"2a593e22-dad7-3a4b-b3c2-c381ec0f2383","product":{"name":"registry.redhat.io/rhceph/grafana-rhel10@sha256:6f01015230f5c2ae3d75b9f0cae11538235e617a22d036dea04f6371769c1299_ppc64le","vendor":{"name":"Red Hat"}}},{"id":"336c104d-be0c-3a71-930f-9796a0f04bbd","product":{"name":"registry.redhat.io/rhceph/rhceph-haproxy-rhel10@sha256:2dd73def241db73d57cdac5cfc8f7e9b32728de0b86007dd28a4a33d91680d4d_s390x","vendor":{"name":"Red Hat"}}},{"id":"58c6780b-ade4-36aa-a3ef-d85ccf48d54b","product":{"name":"registry.redhat.io/rhceph/oauth2-proxy-rhel10@sha256:ad80f5f61a2f2c3bb39c4d787fba18dc3a3d99ac688b07110b946ff3c8c31bc4_s390x","vendor":{"name":"Red Hat"}}},{"id":"59fad50d-49dc-3744-a47b-9eb61e630ce0","product":{"name":"Red Hat Ceph Storage 9.2","vendor":{"name":"Red Hat"}}},{"id":"62c7aa0c-f798-3715-973a-40fe1f782ed6","product":{"name":"registry.redhat.io/rhceph/oauth2-proxy-rhel10@sha256:bde0c68d5c31070466d8708b1e5cdf94587d1a01464ec03d40ebf30f5c7e1b11_ppc64le","vendor":{"name":"Red Hat"}}},{"id":"66c41e54-1020-344f-8ed5-599bf0762a5d","product":{"name":"registry.redhat.io/rhceph/grafana-rhel10@sha256:bf7e7d9293a49520e6c07b6627cc1165b59d40b92ee15010a82735f8c4443602_s390x","vendor":{"name":"Red Hat"}}},{"id":"67841d07-eb9f-3506-958e-3b1f7e65328e","product":{"name":"registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:e5a4422325d975bb20f0ab152279748f6b33ec6b87d6419418917ab25c889e4a_s390x","vendor":{"name":"Red Hat"}}},{"id":"6d6d1116-3b1d-3465-a774-ba53fe216067","product":{"name":"registry.redhat.io/rhceph/alloy-rhel10@sha256:e1cbac58bcf8b551d5ea1b47f94798dcc632d81b38908f462e7d3e91771f60a4_amd64","vendor":{"name":"Red Hat"}}},{"id":"6f111f08-1aa3-3911-881d-eed311ef26e7","product":{"name":"registry.redhat.io/rhceph/keepalived-rhel10@sha256:97d8626437b17428366dccb70fc7d8eb22840623b164b491cceb66de07bc2279_amd64","vendor":{"name":"Red Hat"}}},{"id":"71a5f7d7-9409-3116-a47e-45c8f57bc452","product":{"name":"registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:3bf292a7d44614e5be829d1f3a4daeb2873405bd0886d0802bd32a9aacf6f781_amd64","vendor":{"name":"Red Hat"}}},{"id":"74fbadd0-686a-3d87-b51c-a6ccfda5d94a","product":{"name":"registry.redhat.io/rhceph/rhceph-haproxy-rhel10@sha256:6e1f39f8225811070c27db40eba93cc567d44d43184ca10b317abad99ee0b485_amd64","vendor":{"name":"Red Hat"}}},{"id":"83b3d452-12df-31b3-8a55-e5156f200f05","product":{"name":"registry.redhat.io/rhceph/rhceph-9-rhel10@sha256:4ea52cbdb1c42b970667045f794a8ad75d8d9df236a2d0e4751519a2c0904b87_amd64","vendor":{"name":"Red Hat"}}},{"id":"8baaf5e8-d54a-3d3b-aa04-426d1126dfa8","product":{"name":"registry.redhat.io/rhceph/rhceph-9-rhel10@sha256:8401aa351c60cbb096283b1efaefa0b44012a9487fbee8c8342b77bbdbfb6111_arm64","vendor":{"name":"Red Hat"}}},{"id":"95b65ad3-92d0-3fd8-8042-e1deb59c860b","product":{"name":"registry.redhat.io/rhceph/rhceph-9-rhel10@sha256:dbaea4a6d152c0a28f467dfc77b01d25aeebc0d0b7bb159c991771ff4a680c0d_s390x","vendor":{"name":"Red Hat"}}},{"id":"96f6f7f8-03b0-323c-acd4-80e54cfeabc0","product":{"name":"registry.redhat.io/rhceph/rhceph-9-rhel10@sha256:d6d5f168fb70e819659cdc47a64483b6509f3858b36df465e9c44533ab4af56c_ppc64le","vendor":{"name":"Red Hat"}}},{"id":"9f6b1502-4ee6-307d-b75f-03ffca4756b5","product":{"name":"registry.redhat.io/rhceph/alloy-rhel10@sha256:b8de881870e89c0559238b5e45ec1a197b819b0d76ad1bbeb36732232bcd9ce3_arm64","vendor":{"name":"Red Hat"}}},{"id":"c284f1dc-3f72-36b2-9f8e-79802f2494d2","product":{"name":"registry.redhat.io/rhceph/keepalived-rhel10@sha256:6c9d48d718885dfb5ab96e434f2b6cf1006a878c36595020cf57a8b24108affd_arm64","vendor":{"name":"Red Hat"}}},{"id":"c43bccd8-f7cb-3994-8370-e5ababa647b6","product":{"name":"registry.redhat.io/rhceph/grafana-rhel10@sha256:0fa88412ee250b79e9af3c426d74d2e838342fda5ebe1b99662ae3368ec2b480_amd64","vendor":{"name":"Red Hat"}}},{"id":"cc0e73e7-76fc-3507-be44-b0bc709d6382","product":{"name":"registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:1cb7e79a5c02999ac479fdd43fa2b99c5ad88b7211e7ad8142cdfce833e83e7e_arm64","vendor":{"name":"Red Hat"}}},{"id":"d830d27b-c549-3f8e-8d57-af9a9164a474","product":{"name":"registry.redhat.io/rhceph/rhceph-haproxy-rhel10@sha256:972e07ea652e5c12087fdfa32d1aba063ceb507e7b36ed55f2e54d46c663fce3_arm64","vendor":{"name":"Red Hat"}}}]}},{"id":"67834a7e-5ecf-35b1-8d3a-59679812d404","advisory":{"id":"WID-SEC-W-2026-3046","description":"IBM Concert: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in IBM Concert ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.","datePublished":"Aug 26, 2026, 10:00:00 PM","dateUpdated":"Aug 30, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3046.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-3046\n","aliases":"CVE-2019-19921\nCVE-2021-23337\nCVE-2024-3651\nCVE-2024-39338\nCVE-2024-45590\nCVE-2025-13465\nCVE-2025-15284\nCVE-2025-15599\nCVE-2025-22874\nCVE-2025-47273\nCVE-2025-47907\nCVE-2025-52881\nCVE-2025-53643\nCVE-2025-55184\nCVE-2025-58056\nCVE-2025-58188\nCVE-2025-58189\nCVE-2025-61723\nCVE-2025-61730\nCVE-2025-64649\nCVE-2025-64756\nCVE-2025-67221\nCVE-2025-68121\nCVE-2025-68146\nCVE-2026-0540\nCVE-2026-2327\nCVE-2026-23490\nCVE-2026-23897\nCVE-2026-2391\nCVE-2026-23949\nCVE-2026-24486\nCVE-2026-25528\nCVE-2026-25547\nCVE-2026-25639\nCVE-2026-25990\nCVE-2026-26007\nCVE-2026-26019\nCVE-2026-26996\nCVE-2026-27142\nCVE-2026-27212\nCVE-2026-27699\nCVE-2026-27903\nCVE-2026-27904\nCVE-2026-28684\nCVE-2026-29063\nCVE-2026-29181\nCVE-2026-2950\nCVE-2026-31808\nCVE-2026-31900\nCVE-2026-32274\nCVE-2026-32288\nCVE-2026-32597\nCVE-2026-32630\nCVE-2026-32887\nCVE-2026-32952\nCVE-2026-33186\nCVE-2026-33532\nCVE-2026-33750\nCVE-2026-33814\nCVE-2026-33816\nCVE-2026-33916\nCVE-2026-34043\nCVE-2026-34073\nCVE-2026-34077\nCVE-2026-3520\nCVE-2026-35469\nCVE-2026-35515\nCVE-2026-3627\nCVE-2026-39823\nCVE-2026-39825\nCVE-2026-39826\nCVE-2026-39892\nCVE-2026-39984\nCVE-2026-40175\nCVE-2026-40179\nCVE-2026-40181\nCVE-2026-40190\nCVE-2026-40347\nCVE-2026-41066\nCVE-2026-41182\nCVE-2026-41238\nCVE-2026-41239\nCVE-2026-41240\nCVE-2026-41305\nCVE-2026-41324\nCVE-2026-41425\nCVE-2026-41481\nCVE-2026-41488\nCVE-2026-41602\nCVE-2026-41636\nCVE-2026-42151\nCVE-2026-42154\nCVE-2026-42198\nCVE-2026-42211\nCVE-2026-42338\nCVE-2026-42342\nCVE-2026-42561\nCVE-2026-42577\nCVE-2026-43870\nCVE-2026-44405\nCVE-2026-44431\nCVE-2026-44432\nCVE-2026-44486\nCVE-2026-44487\nCVE-2026-44488\nCVE-2026-44492\nCVE-2026-44494\nCVE-2026-44496\nCVE-2026-44728\nCVE-2026-4539\nCVE-2026-45409\nCVE-2026-45736\nCVE-2026-46625\nCVE-2026-4800\nCVE-2026-4923\nCVE-2026-4926\nCVE-2026-7246\nCVE-2026-8723\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"76a90dbd-da59-3443-a232-e3bd24181126","product":{"name":"Concert","vendor":{"name":"IBM"}}},{"id":"cc1d243a-3c05-3835-99df-7ead0933e4bb","product":{"name":"3.0.0","vendor":{"name":"ECOVACS"}}}]}}]}