security(deps): upgrade bundled DOMPurify in TinyMCE / Monaco / Swagger UI assets (CVE-2025-26791 follow-up)

Context

Follow-up to CVE-2025-26791 (DOMPurify mXSS, < 3.2.4). The transitive npm dep was bumped from 3.1.6 → 3.3.3 via a mermaid upgrade and is patched on both main and the 25.07 LTS branch.

However, dotCMS also ships older bundled DOMPurify copies inside upstream third-party UI assets that were not touched by the npm bump:

• dotCMS/src/main/webapp/ext/tinymcev7/themes/silver/theme.min.js
• dotCMS/src/main/webapp/ext/tinymcev7/tinymce.js
• dotCMS/src/main/webapp/ext/tinymcev7/tinymce.min.js
• dotCMS/src/main/webapp/html/assets/monaco-editor/min/vs/editor/editor.main.js
• dotCMS/src/main/webapp/html/portlet/ext/apiplayground/swagger-ui-bundle.js

Risk assessment

Low. These bundles are loaded only in authenticated admin contexts (TinyMCE editor, Monaco code editor, Swagger UI playground). They are not exposed to anonymous / user-generated content. The mutation-XSS pre-condition for CVE-2025-26791 (untrusted HTML rendered into a privileged DOM context) does not apply to admin-only inputs.

Why we still need this

Customer pen-test scanners frequently fingerprint JavaScript files inside the WAR, not just the dependency graph. They will flag these files as containing a vulnerable DOMPurify version even though the runtime risk is nil — generating customer support tickets like Freshdesk #37533 (Equiniti).

What to do

For each of the 5 files:

1. Upgrade the upstream bundle to a version that ships DOMPurify ≥ 3.2.4:
   • TinyMCE v7: confirm latest 7.x bundle ships patched DOMPurify
   • Monaco editor: same — check current release notes for DOMPurify bump
   • Swagger UI: same — verify bundle version
2. If an upstream bundle still ships an older DOMPurify, file an upstream issue and consider shimming / stripping the bundled copy.
3. Add an OWASP suppression entry with a clear justification for any cases where the upstream hasn't patched yet, so future scans don't re-flag.

Scope

• Not in scope for the LTS 25.07.10 release that customers are currently waiting on (that release closes the npm-level DOMPurify finding via the mermaid bump). This issue is hygiene for a subsequent release.
• Trunk-only fix is fine initially; backport to LTS only if a customer specifically reports it.

Related

• CVE: https://nvd.nist.gov/vuln/detail/CVE-2025-26791
• Customer ticket: Freshdesk #37533
• Related ticket (separate CVE-2025-14813 BC fix on the same LTS): Freshdesk #37703 → tracked at #35896 / merged in #35897 + #35901