CVE-2026-65902 Details

A vulnerability exists in DOMPurify versions prior to 3.4.7, specifically in versions 3.4.5 and earlier. The issue arises because the library passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets into the uponSanitizeElement and uponSanitizeAttribute hooks. This occurs via data.allowedTags and data.allowedAttributes when the sanitize function is called without an explicit cfg.ALLOWED_TAGS or cfg.ALLOWED_ATTR array. Hooks that mutate these fields can permanently widen the default allow-lists for the lifetime of the DOMPurify instance. As a result, all subsequent sanitize calls using the default configuration inherit these widened defaults, allowing attacker payloads that exploit the modified tag or attribute names to survive the sanitization process. Notably, the methods removeAllHooks(), clearConfig(), and passing a fresh cfg do not restore the original state; only creating a new DOMPurify instance can revert the changes.

Users can upgrade to DOMPurify version 3.4.7 or later, where this vulnerability has been patched.