Skip to main content

DOMPurify CVE-2026-65902

| EUVDEUVD-2026-48271 MEDIUM
Trust Boundary Violation (CWE-501)
2026-07-23 VulnCheck
Information Disclosure Dompurify Suse Red Hat
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.7 MEDIUM

AC:H reflects the specific hook mutation precondition required; S:C because poisoning crosses trust boundary to affect all subsequent instance callers.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
SUSE
6.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Red Hat
6.1 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Jul 23, 2026 - 13:55 vuln.today
Analysis Generated
Jul 23, 2026 - 13:55 vuln.today
CVE Published
Jul 23, 2026 - 13:16 cve.org
MEDIUM 5.3

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 26 npm packages depend on dompurify (18 direct, 8 indirect)

Ecosystem-wide dependent count for version 3.4.7.

DescriptionCVE.org

DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitize calls inherit the widened defaults and attacker payloads using the poisoned tag/attribute name survive sanitization. removeAllHooks(), clearConfig(), and passing a fresh cfg do not recover the state; only constructing a new DOMPurify instance does.

AnalysisAI

Hook mutation pollution in DOMPurify <= 3.4.5 allows persistent bypass of HTML sanitization defaults when application-installed hooks mutate data.allowedTags or data.allowedAttributes. Because these hook fields are direct references to the library's live DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets rather than copies, any write inside a uponSanitizeElement or uponSanitizeAttribute hook permanently widens the global allow-lists for the entire lifetime of the DOMPurify instance - meaning all subsequent sanitize() calls under default config will pass through attacker-controlled HTML using the poisoned tag or attribute name. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; real-world risk is gated on the presence of the specific hook mutation pattern in the target application.

Technical ContextAI

DOMPurify (npm: dompurify, cure53/DOMPurify, CPE: cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*) is the dominant client-side HTML sanitization library for JavaScript. The flaw resides in the hook execution paths at src/purify.ts lines 1206-1209 (uponSanitizeElement) and 1494-1500 (uponSanitizeAttribute), where ALLOWED_TAGS and ALLOWED_ATTR are passed to hook callbacks as direct object references rather than defensive copies. When sanitize() is called without explicit cfg.ALLOWED_TAGS or cfg.ALLOWED_ATTR, the live sets themselves are direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR constants, completing the reference chain from hook callback to global constant. CWE-501 (Trust Boundary Violation) applies because a hook-scoped mutation leaks across the trust boundary into the global default state; CWE-693 (Protection Mechanism Failure) applies because the core protection mechanism - the default allow-list - is silently widened for all callers without any indication. The advisory notes the maintainer had already implemented a defensive clone at purify.ts:696-700 for the cfg.ADD_TAGS code path, demonstrating awareness of this class of bug; the hook path was the gap. The fix in 3.4.7 (commit 7996f1dc) closes this gap by cloning the sets before passing them to hook callbacks.

RemediationAI

Upgrade DOMPurify to version 3.4.7 or later, which contains the defensive clone fix from commit 7996f1dc78eb8b7922388aed75d94a9f8fad9a36 (https://github.com/cure53/DOMPurify/commit/7996f1dc78eb8b7922388aed75d94a9f8fad9a36). Install via npm with npm install dompurify@3.4.7. The vendor advisory is at https://github.com/cure53/DOMPurify/security/advisories/GHSA-76mc-f452-cxcm. If immediate upgrade is not feasible, two workarounds exist with trade-offs: (1) Refactor all uponSanitizeElement and uponSanitizeAttribute hooks to avoid writing to data.allowedTags or data.allowedAttributes entirely - instead, pass an explicit cfg.ALLOWED_TAGS or cfg.ALLOWED_ATTR array to every sanitize() call so the live DEFAULT sets are never used as the reference base; this requires audit of all hook implementations and callers. (2) Construct a fresh DOMPurify instance for each sanitization context that requires different allow-lists, discarding instances after hook-mutating operations - this trades object allocation cost for state isolation. Note that removeAllHooks(), clearConfig(), and passing a fresh cfg object do NOT remediate already-poisoned state; only a new instance does.

More in Dompurify

View all
CVE-2024-47875 MEDIUM POC
6.1 Oct 11

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated medium severity (CVSS 6
CVE-2020-26870 MEDIUM POC
6.1 Oct 07

Cure53 DOMPurify before 2.0.17 allows mutation XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp
CVE-2019-16728 MEDIUM POC
6.1 Sep 24

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demo
CVE-2024-48910 CRITICAL
9.8 Oct 31

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated critical severity (CVSS
CVE-2026-65914 MEDIUM POC
5.3 Jul 23

Mutation-XSS in DOMPurify before 3.3.2 enables JavaScript execution in victim browsers when sanitized output is re-inser
CVE-2026-65899 MEDIUM POC
5.1 Jul 23

Trusted Types policy state contamination in DOMPurify 3.0.0-3.4.8 allows a previously supplied TRUSTED_TYPES_POLICY to s
CVE-2026-65913 MEDIUM POC
5.1 Jul 23

Prototype pollution in DOMPurify's USE_PROFILES mode enables DOM-based XSS by causing the sanitizer to accept event hand
CVE-2026-65912 MEDIUM POC
5.1 Jul 23

URI validation bypass in DOMPurify 3.3.1 and earlier allows `javascript:` protocol payloads to survive HTML sanitization
CVE-2026-65900 MEDIUM POC
5.1 Jul 23

SAFE_FOR_TEMPLATES bypass in DOMPurify 3.0.0-3.4.7 allows template expressions such as ${evil}, {{evil}}, and <%evil%> t
CVE-2026-65901 MEDIUM POC
5.1 Jul 23

Cross-site scripting in DOMPurify 3.4.6 and earlier enables script execution when the library's IN_PLACE sanitization mo
CVE-2026-65898 MEDIUM POC
5.1 Jul 23

Stored XSS is achievable in applications using DOMPurify's setConfig() API combined with an uponSanitizeAttribute hook t
CVE-2025-26791 MEDIUM POC
4.5 Feb 14

DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site sc

Same weakness CWE-501 – Trust Boundary Violation

View all
CVE-2024-23682 HIGH POC
8.2
CVE-2026-25725 CRITICAL
10.0
CVE-2020-4077 CRITICAL
9.9
CVE-2022-1799 CRITICAL
9.8
CVE-2020-4076 CRITICAL
9.0
CVE-2026-44091 HIGH
8.8
CVE-2024-49050 HIGH
8.8
CVE-2026-33828 HIGH
7.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Module for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise Server for SAP applications 16.0 Affected

Share

CVE-2026-65902 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy