PT-2026-64287 · Cure53 · Dompurify

Rikuxx0 · CVE-2026-66010 · Publicado 2026-07-24 · Atualizado 2026-07-24

NVD

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM ELEMENT HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into innerHTML sinks, creating second-order XSS gadgets.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-66010

Produtos afetados

Dompurify

Referências · 3

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-c2j3-45gr-mqc4 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-66010 · Nota de Segurança
• https://vulncheck.com/advisories/dompurify-before-hook-bypass-via-custom-element-handling · Nota