CVE-2026-82642: Dompurify Incomplete Forbid Tags Iframe Srcdoc

DOMPurify is configured with FORBID_TAGS but does not forbid 'iframe' tags or the 'srcdoc' attribute. DOMPurify does not parse or sanitize the content of the 'srcdoc' attribute, allowing arbitrary script execution via embedded iframe elements. Include 'iframe' in FORBID_TAGS and 'srcdoc' in FORBID_ATTR.

Provally CuratedPublic repositoryMediumMedium confidenceVerifiedApache-2.0

greprules fetch cve-2026-82642-dompurify-incomplete-forbid-tags-iframe-srcdoc --engine opengrep

Description

License: Apache-2.0
Source context: Public repository
Source: Provally CVE rule catalog
Validation status: Verified
Quality signals: 108 downloads
0 direct108 via packs
· 0 stars · Quality score 77How quality works
Included packs: 2 packs

Community feedback

0 rule-level signals from signed-in users.

Useful reports: 0
Context false positives: 0
Metadata suggestions: 0

Contextual precision

Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.

Findings observed: 0
Projects: 0
Reporters: 0

Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.

Finding verdicts0

No approved finding verdicts yet.

Scan diagnostics0

No scan diagnostics reported yet.