CVE-2019-16728: CURE53 Dompurify

Medium severity, CVSS 6.1. EPSS: 1.7% chance of exploitation in the next 30 days.

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.

Affected products

• CURE53 Dompurify: before 2.0.1 (fixed in 2.0.1)
• Debian Debian Linux: version 9.0 only

Published 2019-09-24. Last modified 2026-06-17.