Skip to main content

DOMPurify CVE-2026-65903

| EUVDEUVD-2026-48272 MEDIUM
Incorrect Comparison (CWE-697)
2026-07-23 VulnCheck
Authentication Bypass Dompurify Red Hat Suse
5.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.7 MEDIUM

AC:H reflects the non-default configuration prerequisite (ADD_TAGS function form plus overlapping FORBID_TAGS); S:C and C:L/I:L capture downstream XSS impact in the browser rendering context.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
SUSE
6.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Red Hat
6.1 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

4
Patch available
Jul 23, 2026 - 15:18 EUVD
Source Code Evidence Fetched
Jul 23, 2026 - 13:54 vuln.today
Analysis Generated
Jul 23, 2026 - 13:54 vuln.today
CVE Published
Jul 23, 2026 - 13:16 cve.org
MEDIUM 5.1

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 61 npm packages depend on dompurify (31 direct, 30 indirect)

Ecosystem-wide dependent count for version 3.4.0.

DescriptionCVE.org

DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.

AnalysisAI

DOMPurify versions up to and including 3.3.3 incorrectly resolves a tag-allow conflict when ADD_TAGS is used in its function form alongside FORBID_TAGS, causing forbidden tags to survive sanitization. The flaw is a short-circuit evaluation error in purify.ts (lines 1117-1123): when the ADD_TAGS callback (tagCheck) returns true for a tag, the Boolean AND short-circuits, meaning FORBID_TAGS is never consulted - directly contradicting the attribute-side behavior where FORBID_ATTR always wins. An attacker who can supply HTML to an application using this specific configuration can inject tags the developer explicitly intended to block, leading to XSS or related injection in whatever context the sanitized output is rendered. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.

Technical ContextAI

DOMPurify (npm: dompurify, CPE cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*) is the dominant HTML sanitization library in the JavaScript ecosystem, authored by cure53. Its core sanitization loop evaluates each parsed tag against allow/block lists to produce safe output. The vulnerability manifests specifically in EXTRA_ELEMENT_HANDLING.tagCheck - the function form of ADD_TAGS - where the composite Boolean condition !(tagCheck(tagName)) && (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) short-circuits: a truthy tagCheck result makes the outer AND false, so the element is kept and FORBID_TAGS is never evaluated. The attribute side (line 1214) correctly places if (FORBID_ATTR[lcName]) { continue; } first, creating an asymmetric inconsistency. CWE-697 (Incorrect Comparison) describes the root cause precisely - the comparison logic produces the wrong truth value in the overlapping ADD_TAGS-function + FORBID_TAGS case, not a missing check but a logically incorrect ordering of operands.

RemediationAI

Vendor-released patch: DOMPurify 3.4.0. Upgrade via npm (npm install dompurify@3.4.0 or npm install dompurify@latest) or update the lockfile pinning. The fix restructures the tag-check condition to evaluate FORBID_TAGS before tagCheck, consistent with the attribute-side pattern. See the GitHub advisory GHSA-39q2-94rc-95cp at https://github.com/cure53/DOMPurify/security/advisories/GHSA-39q2-94rc-95cp for patch details. If immediate upgrade is not possible, the most effective workaround is to stop using ADD_TAGS as a function (EXTRA_ELEMENT_HANDLING.tagCheck) and convert to the array form of ADD_TAGS - this entirely avoids the vulnerable code path with no functional side effects for most use cases. If the function form is required, move FORBID_TAGS enforcement into a post-sanitization step that strips the relevant tags from DOMPurify output, noting that post-processing introduces a second parse and its own risk of parser differential. Do not rely on FORBID_TAGS alone for security guarantees in configurations using the function ADD_TAGS form on versions <= 3.3.3.

More in Dompurify

View all
CVE-2024-47875 MEDIUM POC
6.1 Oct 11

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated medium severity (CVSS 6
CVE-2020-26870 MEDIUM POC
6.1 Oct 07

Cure53 DOMPurify before 2.0.17 allows mutation XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp
CVE-2019-16728 MEDIUM POC
6.1 Sep 24

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demo
CVE-2024-48910 CRITICAL
9.8 Oct 31

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated critical severity (CVSS
CVE-2026-65914 MEDIUM POC
5.3 Jul 23

Mutation-XSS in DOMPurify before 3.3.2 enables JavaScript execution in victim browsers when sanitized output is re-inser
CVE-2026-65902 MEDIUM POC
5.3 Jul 23

Hook mutation pollution in DOMPurify <= 3.4.5 allows persistent bypass of HTML sanitization defaults when application-in
CVE-2026-65899 MEDIUM POC
5.1 Jul 23

Trusted Types policy state contamination in DOMPurify 3.0.0-3.4.8 allows a previously supplied TRUSTED_TYPES_POLICY to s
CVE-2026-65913 MEDIUM POC
5.1 Jul 23

Prototype pollution in DOMPurify's USE_PROFILES mode enables DOM-based XSS by causing the sanitizer to accept event hand
CVE-2026-65912 MEDIUM POC
5.1 Jul 23

URI validation bypass in DOMPurify 3.3.1 and earlier allows `javascript:` protocol payloads to survive HTML sanitization
CVE-2026-65900 MEDIUM POC
5.1 Jul 23

SAFE_FOR_TEMPLATES bypass in DOMPurify 3.0.0-3.4.7 allows template expressions such as ${evil}, {{evil}}, and <%evil%> t
CVE-2026-65901 MEDIUM POC
5.1 Jul 23

Cross-site scripting in DOMPurify 3.4.6 and earlier enables script execution when the library's IN_PLACE sanitization mo
CVE-2026-65898 MEDIUM POC
5.1 Jul 23

Stored XSS is achievable in applications using DOMPurify's setConfig() API combined with an uponSanitizeAttribute hook t

Same weakness CWE-697 – Incorrect Comparison

View all
CVE-2020-5849 HIGH POC
7.5
CVE-2025-3102 HIGH POC
8.1
CVE-2023-32571 CRITICAL POC
9.8
CVE-2021-35973 CRITICAL POC
9.8
CVE-2025-48952 CRITICAL POC
9.4
CVE-2020-13485 CRITICAL POC
9.1
CVE-2026-67207 HIGH POC
8.7
CVE-2023-46009 HIGH POC
7.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Module for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise Server for SAP applications 16.0 Affected

Share

CVE-2026-65903 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy