PT-2026-63988 · Dompurify · Dompurify

Offset · CVE-2026-65902 · Published 2026-06-15 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.4.7

Description When the sanitize function is called without an explicit cfg.ALLOWED TAGS or cfg.ALLOWED ATTR array, direct references to the module-level DEFAULT ALLOWED TAGS and DEFAULT ALLOWED ATTR sets are passed to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags and data.allowedAttributes. If a hook mutates these fields, it permanently expands the default allow-lists for the duration of the DOMPurify instance. Consequently, subsequent calls using the default configuration inherit these widened defaults, allowing attacker payloads containing the poisoned tag or attribute names to bypass sanitization. The state cannot be recovered using removeAllHooks(), clearConfig(), or by passing a new configuration; only the creation of a new DOMPurify instance resolves the state.

Recommendations Update to version 3.4.7 or later.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-501

CWE-693

Related Identifiers

CVE-2026-65902

GHSA-76MC-F452-CXCM

Affected Products

Dompurify

References · 8

• 🔥 https://github.com/cure53/DOMPurify/security/advisories/GHSA-76mc-f452-cxcm · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65902.json · Exploit
• https://github.com/cure53/DOMPurify/commit/7996f1dc78eb8b7922388aed75d94a9f8fad9a36 · Patch
• https://osv.dev/vulnerability/GHSA-76mc-f452-cxcm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-65902 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-65902 · Security Note
• https://github.com/cure53/DOMPurify · Note
• https://vulncheck.com/advisories/dompurify-before-hook-mutation-pollution-via-allowedtags · Note