CVE-2026-66010 Details
Description
DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into innerHTML sinks, creating second-order XSS gadgets.
A vulnerability exists in DOMPurify versions prior to 3.4.12, where the 'afterSanitizeElements' hook is not executed for custom elements allowed through 'CUSTOM_ELEMENT_HANDLING.tagNameCheck'. This oversight enables attributes to circumvent application security policies. As a result, sensitive attributes can be retained on custom elements and later injected into 'innerHTML' sinks, creating second-order Cross-Site Scripting (XSS) vulnerabilities.
Users can update DOMPurify to version 3.4.12 or later, and ensure that allowed custom elements pass through the 'afterSanitizeElements' hook. Additionally, documentation should be updated to clarify that elements preserved via 'CUSTOM_ELEMENT_HANDLING' may not follow the same post-sanitization hook process as regular elements.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cure53/DOMPurify/security/advisories/GHSA-c2j3-45gr-mqc4 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/cure53/DOMPurify/security/advisories/GHSA-c2j3-45gr-mqc4 | [email protected] | ExploitVendor Advisory |
| https://www.vulncheck.com/advisories/dompurify-before-hook-bypass-via-custom-element-handling | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cure53 dompurify | < 3.4.12 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | Initial Analysis | [email protected] |
| Jul 24, 2026 | CVE Modified | CISA-ADP |
| Jul 24, 2026 | New CVE Received | [email protected] |