PT-2026-64287 · Cure53 · Dompurify

Rikuxx0 · CVE-2026-66010 · Published 2026-07-24 · Updated 2026-07-24

NVD

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM ELEMENT HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into innerHTML sinks, creating second-order XSS gadgets.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-66010

Affected Products

Dompurify

References · 3

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-c2j3-45gr-mqc4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-66010 · Security Note
• https://vulncheck.com/advisories/dompurify-before-hook-bypass-via-custom-element-handling · Note