CVE-2026-65914 describes a mutation-XSS vulnerability in DOMPurify prior to version 3.3.2. The issue arises when sanitized HTML content is inserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can exploit this by crafting payloads containing closing sequences that break out of the wrapper context during the reparsing phase, reactivating dangerous markup with event handlers that execute arbitrary JavaScript code. This vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. No official patch or remediation guidance is provided in the available data, and no known exploits are reported in the wild.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the affected web application, potentially leading to cross-site scripting attacks. This can result in unauthorized actions on behalf of users, data theft, or session hijacking. The vulnerability specifically affects scenarios where sanitized HTML is reinserted into certain special parsing contexts, increasing the risk of script injection despite the use of DOMPurify.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid reinserting sanitized HTML into the specified special parsing contexts (script, xmp, iframe, noembed, noframes, noscript) using innerHTML until an official fix or guidance is available. Monitor the DOMPurify project for updates and apply any official fixes once released.