Skip to main content

DOMPurify CVE-2026-65899

| EUVDEUVD-2026-48268 MEDIUM
Protection Mechanism Failure (CWE-693)
2026-07-23 VulnCheck
Information Disclosure Dompurify Suse Red Hat
5.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.7 MEDIUM

AC:H reflects three specific co-requisites (shared instance, TRUSTED_TYPES_POLICY set by earlier caller, RETURN_TRUSTED_TYPE used by later caller); S:C because the Trusted Types security boundary is crossed; no availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
SUSE
6.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Red Hat
6.1 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Jul 23, 2026 - 13:55 vuln.today
Analysis Generated
Jul 23, 2026 - 13:55 vuln.today
CVE Published
Jul 23, 2026 - 13:16 cve.org
MEDIUM 5.1

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 291 npm packages depend on dompurify (15 direct, 277 indirect)

Ecosystem-wide dependent count for version 3.4.9.

DescriptionCVE.org

DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Passing TRUSTED_TYPES_POLICY: null on the later call also does not clear the retained policy.

AnalysisAI

Trusted Types policy state contamination in DOMPurify 3.0.0-3.4.8 allows a previously supplied TRUSTED_TYPES_POLICY to survive a clearConfig() call, poisoning subsequent sanitize() calls that request RETURN_TRUSTED_TYPE output. Any application that reuses a single DOMPurify instance across trust boundaries - where one integration sets a permissive or attacker-influenced TRUSTED_TYPES_POLICY and a later caller invokes clearConfig() expecting a clean slate - will receive a TrustedHTML object signed by the old policy, potentially enabling script execution at a Trusted Types sink. A public proof-of-concept is attached to the GHSA advisory; exploitation is not confirmed in CISA KEV.

Technical ContextAI

DOMPurify (cpe:2.3:a:cure53:dompurify:*) is a widely used DOM-based XSS sanitizer for JavaScript. This flaw (CWE-693: Protection Mechanism Failure) resides in the internal state machine governing Trusted Types integration. Specifically, _parseConfig() at src/purify.ts:786-812 assigns trustedTypesPolicy when cfg.TRUSTED_TYPES_POLICY is truthy, but the null/default path at lines 813-832 only initializes the internal policy when trustedTypesPolicy === undefined - it does not reset an already-set value. clearConfig() at lines 2133-2136 clears only CONFIG and SET_CONFIG, leaving trustedTypesPolicy and emptyHTML intact. The serialization path at lines 2123-2125 then signs the output with the retained policy when RETURN_TRUSTED_TYPE is true. Passing TRUSTED_TYPES_POLICY: null in a subsequent call also fails to clear the stale reference, compounding the issue. Trusted Types is a browser security mechanism designed to prevent DOM-based XSS by requiring HTML to be wrapped in a TrustedHTML object before being assigned to dangerous sinks; this flaw undermines that guarantee by substituting an unsafe policy object for the expected clean one.

RemediationAI

Upgrade DOMPurify to version 3.4.9 or later (vendor-released patch: 3.4.9), which corrects the clearConfig() implementation to properly reset trustedTypesPolicy. The patch commit is available at https://github.com/cure53/DOMPurify/commit/825e617753ac1169306a542d3174a77f717a0cf6. For teams unable to upgrade immediately, the primary compensating control is to avoid sharing a single DOMPurify instance across trust boundaries - instead, instantiate a fresh DOMPurify instance per trust context, which eliminates the state contamination vector entirely. A secondary workaround is to explicitly pass TRUSTED_TYPES_POLICY: <safe-policy> on every sanitize() call where RETURN_TRUSTED_TYPE is used, rather than relying on clearConfig() to reset state; note that this approach is fragile and depends on caller discipline. Do not rely on TRUSTED_TYPES_POLICY: null to clear a previously set policy, as this is explicitly documented as ineffective in affected versions. The full advisory is at https://github.com/cure53/DOMPurify/security/advisories/GHSA-vxr8-fq34-vvx9.

More in Dompurify

View all
CVE-2024-47875 MEDIUM POC
6.1 Oct 11

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated medium severity (CVSS 6
CVE-2020-26870 MEDIUM POC
6.1 Oct 07

Cure53 DOMPurify before 2.0.17 allows mutation XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp
CVE-2019-16728 MEDIUM POC
6.1 Sep 24

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demo
CVE-2024-48910 CRITICAL
9.8 Oct 31

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated critical severity (CVSS
CVE-2026-65914 MEDIUM POC
5.3 Jul 23

Mutation-XSS in DOMPurify before 3.3.2 enables JavaScript execution in victim browsers when sanitized output is re-inser
CVE-2026-65902 MEDIUM POC
5.3 Jul 23

Hook mutation pollution in DOMPurify <= 3.4.5 allows persistent bypass of HTML sanitization defaults when application-in
CVE-2026-65913 MEDIUM POC
5.1 Jul 23

Prototype pollution in DOMPurify's USE_PROFILES mode enables DOM-based XSS by causing the sanitizer to accept event hand
CVE-2026-65912 MEDIUM POC
5.1 Jul 23

URI validation bypass in DOMPurify 3.3.1 and earlier allows `javascript:` protocol payloads to survive HTML sanitization
CVE-2026-65900 MEDIUM POC
5.1 Jul 23

SAFE_FOR_TEMPLATES bypass in DOMPurify 3.0.0-3.4.7 allows template expressions such as ${evil}, {{evil}}, and <%evil%> t
CVE-2026-65901 MEDIUM POC
5.1 Jul 23

Cross-site scripting in DOMPurify 3.4.6 and earlier enables script execution when the library's IN_PLACE sanitization mo
CVE-2026-65898 MEDIUM POC
5.1 Jul 23

Stored XSS is achievable in applications using DOMPurify's setConfig() API combined with an uponSanitizeAttribute hook t
CVE-2025-26791 MEDIUM POC
4.5 Feb 14

DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site sc

Same weakness CWE-693 – Protection Mechanism Failure

View all
CVE-2013-2465 CRITICAL POC
9.8
CVE-2024-21412 HIGH POC
8.1
CVE-2013-0431 MEDIUM POC
5.3
CVE-2019-1003030 CRITICAL POC
9.9
CVE-2025-40536 HIGH POC
8.1
CVE-2024-38217 MEDIUM POC
5.4
CVE-2026-21513 HIGH
8.8
CVE-2026-21510 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Module for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise Server for SAP applications 16.0 Affected

Share

CVE-2026-65899 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy