PT-2026-63991 · Dompurify · Dompurify

Offset · CVE-2026-65911 · Published 2026-07-23 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.4.0

Description Function predicates provided via ADD ATTR or ADD TAGS to the DOMPurify.sanitize() function persist in the internal state EXTRA ELEMENT HANDLING across multiple calls on the same instance. If a subsequent call to the same instance provides ADD ATTR or ADD TAGS as an array instead of a function, the previous function handler is not cleared or overwritten. This allows the handler to continue approving attacker-controlled attributes or tags, potentially bypassing FORBID TAGS and allowing dangerous event-handler attributes to survive sanitization, which leads to cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites.

Recommendations Update to version 3.4.0.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-65911

GHSA-9P3W-6H5P-CV75

Affected Products

Dompurify

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65911.json · Exploit
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-9p3w-6h5p-cv75 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-65911 · Security Note
• https://osv.dev/vulnerability/CVE-2026-65911 · Vendor Advisory
• https://vulncheck.com/advisories/dompurify-before-xss-via-add-attr-add-tags-state-leakage · Note