PT-2026-63993 · Dompurify · Dompurify

Christos-Eth · CVE-2026-65913 · Published 2026-04-03 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.3.2

Description When operating in USE PROFILES mode, the software is susceptible to prototype pollution. This occurs when attackers pollute Array.prototype properties, such as setting onclick to true, to bypass attribute filtering. Consequently, the system may accept event handlers as allowlisted attributes, leading to DOM-based Cross-Site Scripting (XSS), where malicious scripts are executed in the browser when sanitized markup is rendered.

Recommendations Update to version 3.3.2 or later.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-65913

GHSA-CJ63-JHHR-WCXV

Affected Products

Dompurify

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65913.json · Exploit
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-cj63-jhhr-wcxv · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cj63-jhhr-wcxv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-65913 · Security Note
• https://osv.dev/vulnerability/CVE-2026-65913 · Vendor Advisory
• https://github.com/cure53/DOMPurify · Note
• https://github.com/cure53/DOMPurify/releases/tag/3.3.2 · Note
• https://vulncheck.com/advisories/dompurify-before-prototype-pollution-via-use-profiles · Note