CVE-2026-65898

Summary

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.

Affected Software

Weaknesses

• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882

References

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882
• https://www.vulncheck.com/advisories/dompurify-before-permanent-attribute-allowlist-pollution-via-setconfig

• ←Previous
• Next→