CVE-2026-65898 Details
Description
DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.
A vulnerability in DOMPurify versions prior to 3.4.11 allows for permanent mutation of the ALLOWED_ATTR allowlist when the setConfig() function is used in conjunction with an uponSanitizeAttribute hook. This flaw enables attackers to exploit the shared allowlist by registering a hook that conditionally permits dangerous attributes, such as onerror, for trusted elements. Subsequently, untrusted content can be introduced that inherits the compromised allowlist, leading to the execution of event handlers and causing stored cross-site scripting (XSS) vulnerabilities.
Users can clear the configuration with DOMPurify.clearConfig() to restore a clean state. However, this vulnerability should be addressed in the DOMPurify library itself by extending the existing clone-guard to the persistent-config fast-path, ensuring that allowlists are cloned before being mutated by hooks.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882 | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882 | [email protected] | ExploitThird Party Advisory |
| https://www.vulncheck.com/advisories/dompurify-before-permanent-attribute-allowlist-pollution-via-setconfig | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cure53 dompurify | < 3.4.11 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | Initial Analysis | [email protected] |
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 23, 2026 | New CVE Received | [email protected] |