PT-2026-63992 · Dompurify · Dompurify

Christos-Eth · CVE-2026-65912 · Published 2026-04-03 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.3.2

Description A URI validation bypass occurs when ADD ATTR is used as a predicate function through EXTRA ELEMENT HANDLING.attributeCheck. This allows attackers to provide a predicate that accepts specific attribute and tag combinations, bypassing URI-safe validation. Consequently, unsafe protocols such as javascript: can bypass sanitization, leading to DOM-based Cross-Site Scripting (XSS)—a vulnerability where malicious scripts are executed in the browser—when the link is activated.

Recommendations Update to version 3.3.2 or later. Restrict the use of the EXTRA ELEMENT HANDLING.attributeCheck predicate function to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-183

Related Identifiers

CVE-2026-65912

GHSA-CJMM-F4JC-QW8R

Affected Products

Dompurify

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65912.json · Exploit
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-cjmm-f4jc-qw8r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-65912 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-65912 · Security Note
• https://osv.dev/vulnerability/GHSA-cjmm-f4jc-qw8r · Vendor Advisory
• https://github.com/cure53/DOMPurify · Note
• https://github.com/cure53/DOMPurify/releases/tag/3.3.2 · Note
• https://vulncheck.com/advisories/dompurify-before-uri-validation-bypass-via-add-attr · Note