Skip to main content

DOMPurify CVE-2026-65911

| EUVDEUVD-2026-48274 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-07-23 VulnCheck
XSS Dompurify Suse Red Hat
5.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.7 MEDIUM

AC:H reflects the non-default two-call mixed-type usage pattern required; S:C and C:L/I:L capture XSS scope change into browser context.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
SUSE
6.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Red Hat
6.1 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

3
Patch available
Jul 23, 2026 - 15:18 EUVD
Analysis Generated
Jul 23, 2026 - 13:52 vuln.today
CVE Published
Jul 23, 2026 - 13:16 cve.org
MEDIUM 5.1

DescriptionCVE.org

In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can allow dangerous event-handler attributes or forbidden tags (bypassing FORBID_TAGS) to survive sanitization, resulting in cross-site scripting. The vendor (Cure53) considers this an edge case outside DOMPurify's threat model; the referenced advisory lists 3.4.0 as the patched version.

AnalysisAI

DOMPurify through 3.3.3 leaks function predicate state across sanitize() calls on the same instance, enabling XSS bypass when applications invoke the library with mixed parameter types for ADD_ATTR or ADD_TAGS. Specifically, a function predicate supplied to one sanitize() call persists in the internal EXTRA_ELEMENT_HANDLING map and is not evicted when a subsequent call on the same instance supplies ADD_ATTR or ADD_TAGS as a plain array, allowing attacker-controlled event-handler attributes or vendor-forbidden tags to survive sanitization. No public exploit or CISA KEV listing is confirmed at time of analysis; the CVSS 4.0 score of 5.1 reflects user interaction required and impact scoped to the subsequent system (browser context), consistent with a reflected or stored XSS consequence.

Technical ContextAI

DOMPurify (CPE: cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*), maintained by Cure53, is a widely-used client-side HTML sanitization library that strips dangerous markup before rendering. Callers can extend its allowlist by passing ADD_ATTR or ADD_TAGS options either as arrays of strings or as function predicates. The bug (CWE-79: Improper Neutralization of Input During Web Page Generation) is a state-management defect: when a function predicate is provided, it is stored in the EXTRA_ELEMENT_HANDLING internal map; on a subsequent sanitize() call with the same instance, if ADD_ATTR or ADD_TAGS is supplied as an array instead of a function, the library fails to clear or overwrite the previously registered function handler. The surviving function predicate continues to approve attributes or tags it was originally configured to allow, defeating any FORBID_TAGS constraints or tighter allowlist supplied by the second call. The root cause is missing invalidation logic for the EXTRA_ELEMENT_HANDLING structure between calls on shared DOMPurify instances.

RemediationAI

Upgrade DOMPurify to version 3.4.0 or later, which is confirmed as the patched release per the vendor advisory at https://github.com/cure53/DOMPurify/security/advisories/GHSA-9p3w-6h5p-cv75. For applications that cannot upgrade immediately, the most direct compensating control is to avoid reusing a single DOMPurify instance across calls with different ADD_ATTR or ADD_TAGS parameter types - instead, construct a new DOMPurify instance (or call DOMPurify.sanitize() with a fresh config object) for each distinct sanitization context. As an additional defense, audit all call sites to confirm whether function predicates are used; if so, restrict ADD_ATTR and ADD_TAGS to string arrays only until the upgrade is complete, eliminating the state-persistence code path entirely. Note that switching to per-call instantiation may carry a minor performance overhead in high-throughput sanitization loops.

More in Dompurify

View all
CVE-2024-47875 MEDIUM POC
6.1 Oct 11

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated medium severity (CVSS 6
CVE-2020-26870 MEDIUM POC
6.1 Oct 07

Cure53 DOMPurify before 2.0.17 allows mutation XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp
CVE-2019-16728 MEDIUM POC
6.1 Sep 24

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demo
CVE-2024-48910 CRITICAL
9.8 Oct 31

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated critical severity (CVSS
CVE-2026-65914 MEDIUM POC
5.3 Jul 23

Mutation-XSS in DOMPurify before 3.3.2 enables JavaScript execution in victim browsers when sanitized output is re-inser
CVE-2026-65902 MEDIUM POC
5.3 Jul 23

Hook mutation pollution in DOMPurify <= 3.4.5 allows persistent bypass of HTML sanitization defaults when application-in
CVE-2026-65899 MEDIUM POC
5.1 Jul 23

Trusted Types policy state contamination in DOMPurify 3.0.0-3.4.8 allows a previously supplied TRUSTED_TYPES_POLICY to s
CVE-2026-65913 MEDIUM POC
5.1 Jul 23

Prototype pollution in DOMPurify's USE_PROFILES mode enables DOM-based XSS by causing the sanitizer to accept event hand
CVE-2026-65912 MEDIUM POC
5.1 Jul 23

URI validation bypass in DOMPurify 3.3.1 and earlier allows `javascript:` protocol payloads to survive HTML sanitization
CVE-2026-65900 MEDIUM POC
5.1 Jul 23

SAFE_FOR_TEMPLATES bypass in DOMPurify 3.0.0-3.4.7 allows template expressions such as ${evil}, {{evil}}, and <%evil%> t
CVE-2026-65901 MEDIUM POC
5.1 Jul 23

Cross-site scripting in DOMPurify 3.4.6 and earlier enables script execution when the library's IN_PLACE sanitization mo
CVE-2026-65898 MEDIUM POC
5.1 Jul 23

Stored XSS is achievable in applications using DOMPurify's setConfig() API combined with an uponSanitizeAttribute hook t

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Module for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise Server for SAP applications 16.0 Affected

Share

CVE-2026-65911 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy