CVE-2020-26870

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/cure53/DOMPurify/commit/02724b8eb048dd219d6725b05c3000936f11d62dPatch, Third Party Advisory
https://github.com/cure53/DOMPurify/compare/2.0.16...2.0.17Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00029.htmlMailing List, Third Party Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-26870Patch, Vendor Advisory
https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/Exploit, Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
https://github.com/cure53/DOMPurify/commit/02724b8eb048dd219d6725b05c3000936f11d62dPatch, Third Party Advisory
https://github.com/cure53/DOMPurify/compare/2.0.16...2.0.17Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00029.htmlMailing List, Third Party Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-26870Patch, Vendor Advisory
https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/Exploit, Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory

Timeline

Published: Oct 7, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-268767.5The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materi CVE-2020-268776.1ApiFest OAuth 2.0 Server 0.3.1 does not validate the redirect URI in accordance with RFC 6749 and is susceptible to an open redirector attac CVE-2020-268788.8Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API (/service/v1/createUs CVE-2020-268799.8Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacker can interact with CVE-2020-26887.1Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (com CVE-2020-268807.8Sympa through 6.2.57b.2 allows a local privilege escalation from the sympa user account to full root access by modifying the sympa.conf conf CVE-2020-268827.5In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input.CVE-2020-268837.5In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents.CVE-2020-268846.1RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability. An unauthenticated remote attacker could potentially exploit CVE-2020-268856.1An issue was discovered in 2sic 2sxc before 11.22. A XSS vulnerability in the sxcver parameter of dnn/ui.html allows an attacker to craft a CVE-2020-268867.8Softaculous before 5.5.7 is affected by a code execution vulnerability because of External Initialization of Trusted Variables or Data Store CVE-2020-268877.8FRITZ!OS before 7.21 on FRITZ!Box devices allows a bypass of a DNS Rebinding protection mechanism.