PT-2026-63984 · Dompurify · Dompurify

Trace37Labs · CVE-2026-65898 · Published 2026-06-18 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.4.11

Description An issue exists where the software fails to clone the ALLOWED ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook. This allows the hook to permanently mutate the shared allowlist. An attacker can register a hook that conditionally allows dangerous attributes, such as onerror, for trusted elements. Subsequently, untrusted content can inherit this polluted allowlist, leading to the execution of event handlers as stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server.

Recommendations Update to version 3.4.11 or later.

Exploit

Fix

XSS

Improper Initialization

Weakness Enumeration

CWE-79

CWE-471

CWE-665

Related Identifiers

CVE-2026-65898

GHSA-CMWH-PVXP-8882

Affected Products

Dompurify

References · 10

• 🔥 https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65898.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-65898 · Security Note
• https://osv.dev/vulnerability/CVE-2026-65898 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cmwh-pvxp-8882 · Vendor Advisory
• https://github.com/cure53/DOMPurify · Note
• https://github.com/cure53/DOMPurify/releases/tag/3.4.11 · Note
• https://github.com/cure53/DOMPurify/commit/011bc3b2fcc4be17aa76f9030e8668207717acb9 · Note
• https://github.com/cure53/DOMPurify/pull/1482 · Note
• https://vulncheck.com/advisories/dompurify-before-permanent-attribute-allowlist-pollution-via-setconfig · Note