EUVD-2026-48286Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because triggering allowlist pollution requires submitting trusted content as a low-privileged user; UI:R for stored XSS victim page load; S:C for cross-origin script execution; no availability impact.
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4Blast Radius
ecosystem impact- 362 npm packages depend on dompurify (46 direct, 316 indirect)
Ecosystem-wide dependent count for version 3.4.11.
DescriptionCVE.org
DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.
AnalysisAI
Stored XSS is achievable in applications using DOMPurify's setConfig() API combined with an uponSanitizeAttribute hook that conditionally permits dangerous attributes for trusted elements. The 3.4.7 patch introduced a clone-guard to prevent hook-driven allowlist mutation, but that guard lives exclusively inside _parseConfig(); setConfig() sets an internal SET_CONFIG flag that causes sanitize() to skip _parseConfig() entirely, handing hooks the live shared ALLOWED_ATTR object. One trusted render permanently poisons the allowlist for the entire DOMPurify instance lifetime, so subsequent attacker-controlled content inherits the mutated policy and retains event-handler attributes like onerror or onclick unstripped. No public exploit or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects that exploitation requires prior privilege to trigger hook pollution and passive victim interaction to realize the XSS.
Technical ContextAI
DOMPurify (npm: dompurify, CPE: cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*) is a client-side JavaScript HTML sanitization library by cure53 that enforces allowlists for tags and attributes. Its ALLOWED_ATTR constant governs which attributes survive sanitization; DOMPurify carries no separate blocklist for /^on/ event handlers - the allowlist is the sole gate. The 3.4.7 release patched a prior hook-pollution bug by cloning ALLOWED_ATTR inside _parseConfig() when an uponSanitizeAttribute hook is registered. CVE-2026-65898 is an incomplete fix: the clone-guard is bypassed because setConfig() sets the module-scoped SET_CONFIG=true flag, and sanitize() checks that flag to skip _parseConfig() for performance - meaning the clone never happens. The hook then receives a direct reference to the shared ALLOWED_ATTR object, and any data.allowedAttributes[name]=true write is permanent for the instance lifetime across all subsequent sanitize() calls and all element types. CWE-79 (Stored/DOM XSS) is the outcome; the root cause class is mutable shared state exposed without isolation, an incomplete remediation pattern.
RemediationAI
Upgrade DOMPurify to version 3.4.11, which is the vendor-released patch confirmed by the GitHub Security Advisory GHSA-cmwh-pvxp-8882. Version 3.4.11 extends the clone-guard beyond _parseConfig() to also cover the setConfig() code path, ensuring hooks always receive an isolated copy of ALLOWED_ATTR. Until the upgrade can be applied, a targeted compensating control is to audit all uponSanitizeAttribute hooks and remove or gate any data.allowedAttributes[name]=true assignments for event-handler attributes (onerror, onclick, onmouseover, onload, srcdoc, formaction, etc.) - hooks that do not write to data.allowedAttributes are not vulnerable. A second workaround is to replace setConfig() usage with per-call config objects passed directly as the second argument to sanitize(), which restores the _parseConfig() code path and the existing clone-guard without requiring a library upgrade; the trade-off is slightly higher per-call overhead and a refactor of call sites. Do not rely on application-layer attribute filtering downstream of DOMPurify as a substitute, as the polluted output is already rendered HTML at that point.
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated medium severity (CVSS 6
Cure53 DOMPurify before 2.0.17 allows mutation XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp
DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demo
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated critical severity (CVSS
Mutation-XSS in DOMPurify before 3.3.2 enables JavaScript execution in victim browsers when sanitized output is re-inser
Hook mutation pollution in DOMPurify <= 3.4.5 allows persistent bypass of HTML sanitization defaults when application-in
Trusted Types policy state contamination in DOMPurify 3.0.0-3.4.8 allows a previously supplied TRUSTED_TYPES_POLICY to s
Prototype pollution in DOMPurify's USE_PROFILES mode enables DOM-based XSS by causing the sanitizer to accept event hand
URI validation bypass in DOMPurify 3.3.1 and earlier allows `javascript:` protocol payloads to survive HTML sanitization
SAFE_FOR_TEMPLATES bypass in DOMPurify 3.0.0-3.4.7 allows template expressions such as ${evil}, {{evil}}, and <%evil%> t
Cross-site scripting in DOMPurify 3.4.6 and earlier enables script execution when the library's IN_PLACE sanitization mo
DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site sc
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
| openSUSE Leap 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP3 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP5 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today