*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2026-49978
Vulnerable Library - dompurify-3.3.3.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.3.tgz
Path to dependency file: /tutorials/vonage_video_react_app-theme-customization/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-theme-customization/project/package.json,/tutorials/vonage_video_react_app-feature-config/project/package.json
Dependency Hierarchy:
- vivid-5.15.1.tgz (Root Library)
- ❌ dompurify-3.3.3.tgz (Vulnerable Library)
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside .content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7.
Publish Date: 2026-07-14
URL: CVE-2026-49978
CVSS 3 Score Details (9.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-06-15
Fix Resolution: https://github.com/cure53/DOMPurify.git - 3.4.7
CVE-2026-41675
Vulnerable Library - xmldom-0.8.11.tgz
A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.
Library home page: https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.11.tgz
Path to dependency file: /tutorials/vonage_video_react_app-feature-config/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-feature-config/project/package.json,/tutorials/vonage_video_react_app-theme-customization/project/package.json
Dependency Hierarchy:
- vivid-5.15.1.tgz (Root Library)
- video.js-8.23.7.tgz
- mpd-parser-1.3.1.tgz
- ❌ xmldom-0.8.11.tgz (Vulnerable Library)
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) "DOMParser" and "XMLSerializer" module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled processing instruction data to be serialized into XML without validating or neutralizing the PI-closing sequence ?>. As a result, an attacker can terminate the processing instruction early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.
Publish Date: 2026-05-07
URL: CVE-2026-41675
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-04-22
Fix Resolution: https://github.com/xmldom/xmldom.git - 0.8.13,https://github.com/xmldom/xmldom.git - 0.9.10
CVE-2026-41674
Vulnerable Library - xmldom-0.8.11.tgz
A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.
Library home page: https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.11.tgz
Path to dependency file: /tutorials/vonage_video_react_app-feature-config/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-feature-config/project/package.json,/tutorials/vonage_video_react_app-theme-customization/project/package.json
Dependency Hierarchy:
- vivid-5.15.1.tgz (Root Library)
- video.js-8.23.7.tgz
- mpd-parser-1.3.1.tgz
- ❌ xmldom-0.8.11.tgz (Vulnerable Library)
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) "DOMParser" and "XMLSerializer" module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, XMLSerializer.serializeToString can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.
Publish Date: 2026-05-07
URL: CVE-2026-41674
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-04-22
Fix Resolution: https://github.com/xmldom/xmldom.git - 0.8.13,https://github.com/xmldom/xmldom.git - 0.9.10
CVE-2026-41673
Vulnerable Library - xmldom-0.8.11.tgz
A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.
Library home page: https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.11.tgz
Path to dependency file: /tutorials/vonage_video_react_app-feature-config/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-feature-config/project/package.json,/tutorials/vonage_video_react_app-theme-customization/project/package.json
Dependency Hierarchy:
- vivid-5.15.1.tgz (Root Library)
- video.js-8.23.7.tgz
- mpd-parser-1.3.1.tgz
- ❌ xmldom-0.8.11.tgz (Vulnerable Library)
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) "DOMParser" and "XMLSerializer" module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.
Publish Date: 2026-05-07
URL: CVE-2026-41673
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-04-22
Fix Resolution: https://github.com/xmldom/xmldom.git - 0.8.13,https://github.com/xmldom/xmldom.git - 0.9.10
CVE-2026-41672
Vulnerable Library - xmldom-0.8.11.tgz
A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.
Library home page: https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.11.tgz
Path to dependency file: /tutorials/vonage_video_react_app-feature-config/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-feature-config/project/package.json,/tutorials/vonage_video_react_app-theme-customization/project/package.json
Dependency Hierarchy:
- vivid-5.15.1.tgz (Root Library)
- video.js-8.23.7.tgz
- mpd-parser-1.3.1.tgz
- ❌ xmldom-0.8.11.tgz (Vulnerable Library)
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) "DOMParser" and "XMLSerializer" module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment-breaking sequences. As a result, an attacker can terminate the comment early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.
Publish Date: 2026-05-07
URL: CVE-2026-41672
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-04-22
Fix Resolution: https://github.com/xmldom/xmldom.git - 0.8.13,https://github.com/xmldom/xmldom.git - 0.9.10
CVE-2026-34601
Vulnerable Library - xmldom-0.8.11.tgz
A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.
Library home page: https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.11.tgz
Path to dependency file: /tutorials/vonage_video_react_app-feature-config/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-feature-config/project/package.json,/tutorials/vonage_video_react_app-theme-customization/project/package.json
Dependency Hierarchy:
- vivid-5.15.1.tgz (Root Library)
- video.js-8.23.7.tgz
- mpd-parser-1.3.1.tgz
- ❌ xmldom-0.8.11.tgz (Vulnerable Library)
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) "DOMParser" and "XMLSerializer" module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only became active XML markup in the serialized output, enabling XML structure injection and downstream business-logic manipulation. This issue has been patched in xmldom version 0.6.0 and @xmldom/xmldom versions 0.8.12 and 0.9.9.
Publish Date: 2026-04-02
URL: CVE-2026-34601
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-04-01
Fix Resolution: https://github.com/xmldom/xmldom.git - 0.9.9
CVE-2026-41238
Vulnerable Library - dompurify-3.3.3.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.3.tgz
Path to dependency file: /tutorials/vonage_video_react_app-theme-customization/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-theme-customization/project/package.json,/tutorials/vonage_video_react_app-feature-config/project/package.json
Dependency Hierarchy:
- vivid-5.15.1.tgz (Root Library)
- ❌ dompurify-3.3.3.tgz (Vulnerable Library)
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
Summary DOMPurify versions 3.0.1 through 3.3.3 (latest) are vulnerable to a prototype pollution-based XSS bypass. When an application uses "DOMPurify.sanitize()" with the default configuration (no "CUSTOM_ELEMENT_HANDLING" option), a prior prototype pollution gadget can inject permissive "tagNameCheck" and "attributeNameCheck" regex values into "Object.prototype", causing DOMPurify to allow arbitrary custom elements with arbitrary attributes — including event handlers — through sanitization. Affected Versions - 3.0.1 through 3.3.3 (current latest) — all affected - 3.0.0 and all 2.x versions — NOT affected (used "Object.create(null)" for initialization, no "|| {}" reassignment) - The vulnerable "|| {}" reassignment was introduced in the 3.0.0→3.0.1 refactor - This is distinct from GHSA-cj63-jhhr-wcxv (USE_PROFILES Array.prototype pollution, fixed in 3.3.2) - This is distinct from CVE-2024-45801 / GHSA-mmhx-hmjr-r674 (__depth prototype pollution, fixed in 3.1.3) Root Cause In "purify.js" at line 590, during config parsing: CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {}; When no "CUSTOM_ELEMENT_HANDLING" is specified in the config (the default usage pattern), "cfg.CUSTOM_ELEMENT_HANDLING" is "undefined", and the fallback "{}" is used. This plain object inherits from "Object.prototype". Lines 591-598 then check "cfg.CUSTOM_ELEMENT_HANDLING" (the original config property) — which is "undefined" — so the conditional blocks that would set "tagNameCheck" and "attributeNameCheck" from the config are never entered. As a result, "CUSTOM_ELEMENT_HANDLING.tagNameCheck" and "CUSTOM_ELEMENT_HANDLING.attributeNameCheck" resolve via the prototype chain. If an attacker has polluted "Object.prototype.tagNameCheck" and "Object.prototype.attributeNameCheck" with permissive values (e.g., "/.*/"), these polluted values flow into DOMPurify's custom element validation at lines 973-977 and attribute validation, causing all custom elements and all attributes to be allowed. Impact - Attack type: XSS bypass via prototype pollution chain - Prerequisites: Attacker must have a prototype pollution primitive in the same execution context (e.g., vulnerable version of lodash, jQuery.extend, query-string parser, deep merge utility, or any other PP gadget) - Config required: Default. No special DOMPurify configuration needed. The standard "DOMPurify.sanitize(userInput)" call is affected. - Payload: Any HTML custom element (name containing a hyphen) with event handler attributes survives sanitization.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-04-23
URL: CVE-2026-41238
CVSS 3 Score Details (6.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-v9jr-rg53-9pgp
Release Date: 2026-04-22
Fix Resolution (dompurify): 3.4.0
Direct dependency fix Resolution (@vonage/vivid): 5.16.0
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2026-41239
Vulnerable Library - dompurify-3.3.3.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.3.tgz
Path to dependency file: /tutorials/vonage_video_react_app-theme-customization/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-theme-customization/project/package.json,/tutorials/vonage_video_react_app-feature-config/project/package.json
Dependency Hierarchy:
- vivid-5.15.1.tgz (Root Library)
- ❌ dompurify-3.3.3.tgz (Vulnerable Library)
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
Summary | Field | Value | |:------|:------| | Severity | Medium | | Affected | DOMPurify "main" at ""883ac15"" (https://github.com/cure53/DOMPurify/tree/883ac15d47f907cb1a3b5a152fe90c4d8c10f9e6), introduced in v1.0.10 (""7fc196db"" (cure53/DOMPurify@7fc196d)) | "SAFE_FOR_TEMPLATES" strips "{{...}}" expressions from untrusted HTML. This works in string mode but not with "RETURN_DOM" or "RETURN_DOM_FRAGMENT", allowing XSS via template-evaluating frameworks like Vue 2. Technical Details DOMPurify strips template expressions in two passes: 1. Per-node — each text node is checked during the tree walk (""purify.ts:1179-1191"" (https://github.com/cure53/DOMPurify/blob/883ac15d47f907cb1a3b5a152fe90c4d8c10f9e6/src/purify.ts#L1179-L1191)): // pass #1: runs on every text node during tree walk if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) { content = currentNode.textContent; content = content.replace(MUSTACHE_EXPR, ' '); // {{...}} -> ' ' content = content.replace(ERB_EXPR, ' '); // <%...%> -> ' ' content = content.replace(TMPLIT_EXPR, ' '); // ${... -> ' ' currentNode.textContent = content; } 2. Final string scrub — after serialization, the full HTML string is scrubbed again (""purify.ts:1679-1683"" (https://github.com/cure53/DOMPurify/blob/883ac15d47f907cb1a3b5a152fe90c4d8c10f9e6/src/purify.ts#L1679-L1683)). This is the safety net that catches expressions that only form after the DOM settles. The "RETURN_DOM" path returns before pass #2 ever runs (""purify.ts:1637-1661"" (https://github.com/cure53/DOMPurify/blob/883ac15d47f907cb1a3b5a152fe90c4d8c10f9e6/src/purify.ts#L1637-L1661)): // purify.ts (simplified) if (RETURN_DOM) { // ... build returnNode ... return returnNode; // <-- exits here, pass #2 never runs } // pass #2: only reached by string-mode callers if (SAFE_FOR_TEMPLATES) { serializedHTML = serializedHTML.replace(MUSTACHE_EXPR, ' '); } return serializedHTML; The payload "{{constructor.constructor('alert(1)')()}}" exploits this: 3. Parser creates: "TEXT("{")" → "" → "TEXT("{payload}")" → "" → "TEXT("}")" — no single node contains "{{", so pass #1 misses it 4. "" is not allowed, so DOMPurify removes it but keeps surrounding text 5. The three text nodes are now adjacent — ".outerHTML" reads them as "{{payload}}", which Vue 2 compiles and executes
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-04-23
URL: CVE-2026-41239
CVSS 3 Score Details (6.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-crv5-9vww-q3g8
Release Date: 2026-04-22
Fix Resolution (dompurify): 3.4.0
Direct dependency fix Resolution (@vonage/vivid): 5.16.0
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2026-41240
Vulnerable Library - dompurify-3.3.3.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.3.tgz
Path to dependency file: /tutorials/vonage_video_react_app-theme-customization/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-theme-customization/project/package.json,/tutorials/vonage_video_react_app-feature-config/project/package.json
Dependency Hierarchy:
- vivid-5.15.1.tgz (Root Library)
- ❌ dompurify-3.3.3.tgz (Vulnerable Library)
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
There is an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit "c361baa" (cure53/DOMPurify@c361baa) added an early exit for FORBID_ATTR at line 1214: /* FORBID_ATTR must always win, even if ADD_ATTR predicate would allow it / if (FORBID_ATTR[lcName]) { return false; } The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely: if ( !( EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName) // true -> short-circuits ) && (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) // never evaluated ) { This allows forbidden elements to survive sanitization with their attributes intact.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-04-23
URL: CVE-2026-41240
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-h7mw-gpvr-xq4m
Release Date: 2026-04-23
Fix Resolution (dompurify): 3.4.0
Direct dependency fix Resolution (@vonage/vivid): 5.16.0
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2026-49459
Vulnerable Library - dompurify-3.3.3.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.3.tgz
Path to dependency file: /tutorials/vonage_video_react_app-theme-customization/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-theme-customization/project/package.json,/tutorials/vonage_video_react_app-feature-config/project/package.json
Dependency Hierarchy:
- vivid-5.15.1.tgz (Root Library)
- ❌ dompurify-3.3.3.tgz (Vulnerable Library)
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled
root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.
Publish Date: 2026-07-14
URL: CVE-2026-49459
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-r47g-fvhr-h676
Release Date: 2026-06-15
Fix Resolution: https://github.com/cure53/DOMPurify.git - 3.4.6,dompurify - 3.4.6
CVE-2026-49458
Vulnerable Library - dompurify-3.3.3.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.3.tgz
Path to dependency file: /tutorials/vonage_video_react_app-theme-customization/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-theme-customization/project/package.json,/tutorials/vonage_video_react_app-feature-config/project/package.json
Dependency Hierarchy:
- vivid-5.15.1.tgz (Root Library)
- ❌ dompurify-3.3.3.tgz (Vulnerable Library)
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches so executable markup could survive. This issue is fixed in version 3.4.6.
Publish Date: 2026-07-14
URL: CVE-2026-49458
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-06-15
Fix Resolution: https://github.com/cure53/DOMPurify.git - 3.4.6
CVE-2026-41988
Vulnerable Library - uuid-11.1.0.tgz
RFC9562 UUIDs
Library home page: https://registry.npmjs.org/uuid/-/uuid-11.1.0.tgz
Path to dependency file: /tutorials/vonage_video_react_app-feature-config/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-feature-config/project/package.json,/tutorials/vonage_video_react_app-theme-customization/project/package.json
Dependency Hierarchy:
- vivid-5.15.1.tgz (Root Library)
- ❌ uuid-11.1.0.tgz (Vulnerable Library)
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.
Publish Date: 2026-04-23
URL: CVE-2026-41988
CVSS 3 Score Details (3.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-04-23
Fix Resolution (uuid): 11.1.1
Direct dependency fix Resolution (@vonage/vivid): 5.16.0
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
Path to dependency file: /tutorials/vonage_video_react_app-theme-customization/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-feature-config/project/package.json,/tutorials/vonage_video_react_app-theme-customization/project/package.json
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - uuid-11.1.0.tgz
RFC9562 UUIDs
Library home page: https://registry.npmjs.org/uuid/-/uuid-11.1.0.tgz
Path to dependency file: /tutorials/vonage_video_react_app-feature-config/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-feature-config/project/package.json,/tutorials/vonage_video_react_app-theme-customization/project/package.json
Dependency Hierarchy:
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.
Publish Date: 2026-04-24
URL: CVE-2026-41907
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-w5hq-g745-h8pq
Release Date: 2026-04-24
Fix Resolution: https://github.com/uuidjs/uuid.git - v11.1.1,https://github.com/uuidjs/uuid.git - v12.0.1,https://github.com/uuidjs/uuid.git - v13.0.1
Vulnerable Library - dompurify-3.3.3.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.3.tgz
Path to dependency file: /tutorials/vonage_video_react_app-theme-customization/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-theme-customization/project/package.json,/tutorials/vonage_video_react_app-feature-config/project/package.json
Dependency Hierarchy:
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside .content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7.
Publish Date: 2026-07-14
URL: CVE-2026-49978
CVSS 3 Score Details (9.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-06-15
Fix Resolution: https://github.com/cure53/DOMPurify.git - 3.4.7
Vulnerable Library - xmldom-0.8.11.tgz
A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.
Library home page: https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.11.tgz
Path to dependency file: /tutorials/vonage_video_react_app-feature-config/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-feature-config/project/package.json,/tutorials/vonage_video_react_app-theme-customization/project/package.json
Dependency Hierarchy:
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) "DOMParser" and "XMLSerializer" module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled processing instruction data to be serialized into XML without validating or neutralizing the PI-closing sequence ?>. As a result, an attacker can terminate the processing instruction early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.
Publish Date: 2026-05-07
URL: CVE-2026-41675
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-04-22
Fix Resolution: https://github.com/xmldom/xmldom.git - 0.8.13,https://github.com/xmldom/xmldom.git - 0.9.10
Vulnerable Library - xmldom-0.8.11.tgz
A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.
Library home page: https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.11.tgz
Path to dependency file: /tutorials/vonage_video_react_app-feature-config/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-feature-config/project/package.json,/tutorials/vonage_video_react_app-theme-customization/project/package.json
Dependency Hierarchy:
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) "DOMParser" and "XMLSerializer" module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, XMLSerializer.serializeToString can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.
Publish Date: 2026-05-07
URL: CVE-2026-41674
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-04-22
Fix Resolution: https://github.com/xmldom/xmldom.git - 0.8.13,https://github.com/xmldom/xmldom.git - 0.9.10
Vulnerable Library - xmldom-0.8.11.tgz
A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.
Library home page: https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.11.tgz
Path to dependency file: /tutorials/vonage_video_react_app-feature-config/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-feature-config/project/package.json,/tutorials/vonage_video_react_app-theme-customization/project/package.json
Dependency Hierarchy:
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) "DOMParser" and "XMLSerializer" module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.
Publish Date: 2026-05-07
URL: CVE-2026-41673
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-04-22
Fix Resolution: https://github.com/xmldom/xmldom.git - 0.8.13,https://github.com/xmldom/xmldom.git - 0.9.10
Vulnerable Library - xmldom-0.8.11.tgz
A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.
Library home page: https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.11.tgz
Path to dependency file: /tutorials/vonage_video_react_app-feature-config/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-feature-config/project/package.json,/tutorials/vonage_video_react_app-theme-customization/project/package.json
Dependency Hierarchy:
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) "DOMParser" and "XMLSerializer" module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment-breaking sequences. As a result, an attacker can terminate the comment early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.
Publish Date: 2026-05-07
URL: CVE-2026-41672
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-04-22
Fix Resolution: https://github.com/xmldom/xmldom.git - 0.8.13,https://github.com/xmldom/xmldom.git - 0.9.10
Vulnerable Library - xmldom-0.8.11.tgz
A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.
Library home page: https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.11.tgz
Path to dependency file: /tutorials/vonage_video_react_app-feature-config/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-feature-config/project/package.json,/tutorials/vonage_video_react_app-theme-customization/project/package.json
Dependency Hierarchy:
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) "DOMParser" and "XMLSerializer" module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only became active XML markup in the serialized output, enabling XML structure injection and downstream business-logic manipulation. This issue has been patched in xmldom version 0.6.0 and @xmldom/xmldom versions 0.8.12 and 0.9.9.
Publish Date: 2026-04-02
URL: CVE-2026-34601
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-04-01
Fix Resolution: https://github.com/xmldom/xmldom.git - 0.9.9
Vulnerable Library - dompurify-3.3.3.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.3.tgz
Path to dependency file: /tutorials/vonage_video_react_app-theme-customization/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-theme-customization/project/package.json,/tutorials/vonage_video_react_app-feature-config/project/package.json
Dependency Hierarchy:
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
Summary DOMPurify versions 3.0.1 through 3.3.3 (latest) are vulnerable to a prototype pollution-based XSS bypass. When an application uses "DOMPurify.sanitize()" with the default configuration (no "CUSTOM_ELEMENT_HANDLING" option), a prior prototype pollution gadget can inject permissive "tagNameCheck" and "attributeNameCheck" regex values into "Object.prototype", causing DOMPurify to allow arbitrary custom elements with arbitrary attributes — including event handlers — through sanitization. Affected Versions - 3.0.1 through 3.3.3 (current latest) — all affected - 3.0.0 and all 2.x versions — NOT affected (used "Object.create(null)" for initialization, no "|| {}" reassignment) - The vulnerable "|| {}" reassignment was introduced in the 3.0.0→3.0.1 refactor - This is distinct from GHSA-cj63-jhhr-wcxv (USE_PROFILES Array.prototype pollution, fixed in 3.3.2) - This is distinct from CVE-2024-45801 / GHSA-mmhx-hmjr-r674 (__depth prototype pollution, fixed in 3.1.3) Root Cause In "purify.js" at line 590, during config parsing: CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {}; When no "CUSTOM_ELEMENT_HANDLING" is specified in the config (the default usage pattern), "cfg.CUSTOM_ELEMENT_HANDLING" is "undefined", and the fallback "{}" is used. This plain object inherits from "Object.prototype". Lines 591-598 then check "cfg.CUSTOM_ELEMENT_HANDLING" (the original config property) — which is "undefined" — so the conditional blocks that would set "tagNameCheck" and "attributeNameCheck" from the config are never entered. As a result, "CUSTOM_ELEMENT_HANDLING.tagNameCheck" and "CUSTOM_ELEMENT_HANDLING.attributeNameCheck" resolve via the prototype chain. If an attacker has polluted "Object.prototype.tagNameCheck" and "Object.prototype.attributeNameCheck" with permissive values (e.g., "/.*/"), these polluted values flow into DOMPurify's custom element validation at lines 973-977 and attribute validation, causing all custom elements and all attributes to be allowed. Impact - Attack type: XSS bypass via prototype pollution chain - Prerequisites: Attacker must have a prototype pollution primitive in the same execution context (e.g., vulnerable version of lodash, jQuery.extend, query-string parser, deep merge utility, or any other PP gadget) - Config required: Default. No special DOMPurify configuration needed. The standard "DOMPurify.sanitize(userInput)" call is affected. - Payload: Any HTML custom element (name containing a hyphen) with event handler attributes survives sanitization.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-04-23
URL: CVE-2026-41238
CVSS 3 Score Details (6.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-v9jr-rg53-9pgp
Release Date: 2026-04-22
Fix Resolution (dompurify): 3.4.0
Direct dependency fix Resolution (@vonage/vivid): 5.16.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - dompurify-3.3.3.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.3.tgz
Path to dependency file: /tutorials/vonage_video_react_app-theme-customization/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-theme-customization/project/package.json,/tutorials/vonage_video_react_app-feature-config/project/package.json
Dependency Hierarchy:
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
Summary | Field | Value | |:------|:------| | Severity | Medium | | Affected | DOMPurify "main" at ""883ac15"" (https://github.com/cure53/DOMPurify/tree/883ac15d47f907cb1a3b5a152fe90c4d8c10f9e6), introduced in v1.0.10 (""7fc196db"" (cure53/DOMPurify@7fc196d)) | "SAFE_FOR_TEMPLATES" strips "{{...}}" expressions from untrusted HTML. This works in string mode but not with "RETURN_DOM" or "RETURN_DOM_FRAGMENT", allowing XSS via template-evaluating frameworks like Vue 2. Technical Details DOMPurify strips template expressions in two passes: 1. Per-node — each text node is checked during the tree walk (""purify.ts:1179-1191"" (https://github.com/cure53/DOMPurify/blob/883ac15d47f907cb1a3b5a152fe90c4d8c10f9e6/src/purify.ts#L1179-L1191)): // pass #1: runs on every text node during tree walk if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) { content = currentNode.textContent; content = content.replace(MUSTACHE_EXPR, ' '); // {{...}} -> ' ' content = content.replace(ERB_EXPR, ' '); // <%...%> -> ' ' content = content.replace(TMPLIT_EXPR, ' '); // ${... -> ' ' currentNode.textContent = content; } 2. Final string scrub — after serialization, the full HTML string is scrubbed again (""purify.ts:1679-1683"" (https://github.com/cure53/DOMPurify/blob/883ac15d47f907cb1a3b5a152fe90c4d8c10f9e6/src/purify.ts#L1679-L1683)). This is the safety net that catches expressions that only form after the DOM settles. The "RETURN_DOM" path returns before pass #2 ever runs (""purify.ts:1637-1661"" (https://github.com/cure53/DOMPurify/blob/883ac15d47f907cb1a3b5a152fe90c4d8c10f9e6/src/purify.ts#L1637-L1661)): // purify.ts (simplified) if (RETURN_DOM) { // ... build returnNode ... return returnNode; // <-- exits here, pass #2 never runs } // pass #2: only reached by string-mode callers if (SAFE_FOR_TEMPLATES) { serializedHTML = serializedHTML.replace(MUSTACHE_EXPR, ' '); } return serializedHTML; The payload "{{constructor.constructor('alert(1)')()}}" exploits this: 3. Parser creates: "TEXT("{")" → "" → "TEXT("{payload}")" → "" → "TEXT("}")" — no single node contains "{{", so pass #1 misses it 4. "" is not allowed, so DOMPurify removes it but keeps surrounding text 5. The three text nodes are now adjacent — ".outerHTML" reads them as "{{payload}}", which Vue 2 compiles and executes
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-04-23
URL: CVE-2026-41239
CVSS 3 Score Details (6.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-crv5-9vww-q3g8
Release Date: 2026-04-22
Fix Resolution (dompurify): 3.4.0
Direct dependency fix Resolution (@vonage/vivid): 5.16.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - dompurify-3.3.3.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.3.tgz
Path to dependency file: /tutorials/vonage_video_react_app-theme-customization/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-theme-customization/project/package.json,/tutorials/vonage_video_react_app-feature-config/project/package.json
Dependency Hierarchy:
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
There is an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit "c361baa" (cure53/DOMPurify@c361baa) added an early exit for FORBID_ATTR at line 1214: /* FORBID_ATTR must always win, even if ADD_ATTR predicate would allow it / if (FORBID_ATTR[lcName]) { return false; } The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely: if ( !( EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName) // true -> short-circuits ) && (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) // never evaluated ) { This allows forbidden elements to survive sanitization with their attributes intact.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-04-23
URL: CVE-2026-41240
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-h7mw-gpvr-xq4m
Release Date: 2026-04-23
Fix Resolution (dompurify): 3.4.0
Direct dependency fix Resolution (@vonage/vivid): 5.16.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - dompurify-3.3.3.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.3.tgz
Path to dependency file: /tutorials/vonage_video_react_app-theme-customization/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-theme-customization/project/package.json,/tutorials/vonage_video_react_app-feature-config/project/package.json
Dependency Hierarchy:
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled
root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.Publish Date: 2026-07-14
URL: CVE-2026-49459
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-r47g-fvhr-h676
Release Date: 2026-06-15
Fix Resolution: https://github.com/cure53/DOMPurify.git - 3.4.6,dompurify - 3.4.6
Vulnerable Library - dompurify-3.3.3.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.3.tgz
Path to dependency file: /tutorials/vonage_video_react_app-theme-customization/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-theme-customization/project/package.json,/tutorials/vonage_video_react_app-feature-config/project/package.json
Dependency Hierarchy:
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches so executable markup could survive. This issue is fixed in version 3.4.6.
Publish Date: 2026-07-14
URL: CVE-2026-49458
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-06-15
Fix Resolution: https://github.com/cure53/DOMPurify.git - 3.4.6
Vulnerable Library - uuid-11.1.0.tgz
RFC9562 UUIDs
Library home page: https://registry.npmjs.org/uuid/-/uuid-11.1.0.tgz
Path to dependency file: /tutorials/vonage_video_react_app-feature-config/project/package.json
Path to vulnerable library: /tutorials/vonage_video_react_app-feature-config/project/package.json,/tutorials/vonage_video_react_app-theme-customization/project/package.json
Dependency Hierarchy:
Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4
Found in base branch: main
Vulnerability Details
uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.
Publish Date: 2026-04-23
URL: CVE-2026-41988
CVSS 3 Score Details (3.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-04-23
Fix Resolution (uuid): 11.1.1
Direct dependency fix Resolution (@vonage/vivid): 5.16.0
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.