CVE-2025-15599 cure53 CVE debrief

Who should care

Defenders responsible for maintaining and securing systems that utilize DOMPurify should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams. They should review and update affected systems and applications to a fixed version to prevent potential attacks.

Why it matters

Defenders should prioritize remediation of the cross-site scripting vulnerability in DOMPurify to prevent potential attacks. The vulnerability allows attackers to bypass attribute sanitization and execute JavaScript when sanitized output is placed inside rawtext elements. Affected systems and applications should be reviewed and updated to a fixed version.

• Potential for cross-site scripting attacks
• Bypass of attribute sanitization
• Execution of JavaScript in rawtext elements
• Verification of affected systems and applications

Technical summary

The vulnerability exists due to missing textarea rawtext element validation in the SAFE_FOR_XML regex, allowing attackers to bypass attribute sanitization and execute JavaScript when sanitized output is placed inside rawtext elements. The vulnerability affects DOMPurify versions 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched. Defenders should prioritize upgrading to a fixed version to address the cross-site scripting vulnerability. Affected systems and applications should be reviewed and updated to a fixed version.

Defensive priority

Defenders should prioritize upgrading to DOMPurify version 3.2.7 or later, or version 2.5.9 or later if using the 2.x branch, to address the cross-site scripting vulnerability.

Recommended defensive actions

• Upgrade to DOMPurify version 3.2.7 or later
• Upgrade to DOMPurify version 2.5.9 or later if using the 2.x branch
• Review and update affected systems and applications
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including affected versions and fixed versions. However, the corpus does not provide information on exploitation or victim impact. The vulnerability was publicly disclosed on 2026-03-03T17:26:05.711Z. There is no evidence of exploitation in the wild, but defenders should verify affected systems and applications. The CVE Program record and NVD detail page provide additional information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.