Skip to main content

DOMPurify CVE-2026-65912

| EUVDEUVD-2026-48275 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-07-23 VulnCheck
XSS Dompurify Suse Red Hat
5.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.7 MEDIUM

AC:H reflects the non-default EXTRA_ELEMENT_HANDLING.attributeCheck configuration required, a condition beyond the attacker's control; S:C and C:L/I:L capture DOM-based XSS cross-context impact on the victim's browser session.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
SUSE
6.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Red Hat
6.1 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

4
Patch available
Jul 23, 2026 - 15:18 EUVD
Source Code Evidence Fetched
Jul 23, 2026 - 13:51 vuln.today
Analysis Generated
Jul 23, 2026 - 13:51 vuln.today
CVE Published
Jul 23, 2026 - 13:16 cve.org
MEDIUM 5.1

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 287 npm packages depend on dompurify (25 direct, 262 indirect)

Ecosystem-wide dependent count for version 3.3.2.

DescriptionCVE.org

DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe protocols like javascript: to survive sanitization and execute as DOM-based XSS when the link is activated.

AnalysisAI

URI validation bypass in DOMPurify 3.3.1 and earlier allows javascript: protocol payloads to survive HTML sanitization and execute as DOM-based XSS when a crafted link is activated. The flaw exists in the _isValidAttribute function, which short-circuits before URI-safe validation runs when a caller-supplied predicate via EXTRA_ELEMENT_HANDLING.attributeCheck returns true for a given attribute/tag pair. Exploitation is conditioned on the consuming application using the non-default ADD_ATTR predicate API, but a working proof-of-concept is confirmed in the official GHSA advisory; no CISA KEV listing is present at time of analysis.

Technical ContextAI

DOMPurify (npm/dompurify, CPE: cpe:2.3:a:cure53:dompurify) is a JavaScript HTML sanitization library designed to strip dangerous markup before DOM insertion. The EXTRA_ELEMENT_HANDLING.attributeCheck API allows callers to extend attribute allowlisting by passing a predicate function as ADD_ATTR. Internally, _isValidAttribute evaluates this predicate before performing URI-safe validation; when the predicate returns true, the function exits early, skipping the check that would otherwise block javascript:, vbscript:, and other unsafe URI schemes. The root cause maps to CWE-79 (Improper Neutralization of Input During Web Page Generation): caller-controlled logic is permitted to override a core sanitization invariant, breaking the library's safety contract. The vulnerability was identified by Cantina's Apex security team.

RemediationAI

Vendor-released patch: DOMPurify 3.3.2 resolves the URI validation bypass by ensuring URI-safe checks are not skipped when a caller-supplied predicate returns true; upgrade immediately via npm install dompurify@3.3.2 or equivalent. Full details are in the vendor advisory at https://github.com/cure53/DOMPurify/security/advisories/GHSA-cjmm-f4jc-qw8r. For teams unable to upgrade immediately, the most effective compensating control is to remove or restrict use of EXTRA_ELEMENT_HANDLING.attributeCheck with ADD_ATTR predicates that return true for URI-bearing attributes such as href, src, or action; this eliminates the short-circuit path entirely. If the custom predicate is operationally required, add an explicit URI scheme blocklist within the predicate itself (e.g., reject values matching ^javascript: or ^vbscript: before returning true) as a temporary measure - note this shifts safety enforcement from the library to application code and must be treated as a stopgap only, as scheme detection in application code is error-prone and may be bypassed by encoding variants.

More in Dompurify

View all
CVE-2024-47875 MEDIUM POC
6.1 Oct 11

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated medium severity (CVSS 6
CVE-2020-26870 MEDIUM POC
6.1 Oct 07

Cure53 DOMPurify before 2.0.17 allows mutation XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp
CVE-2019-16728 MEDIUM POC
6.1 Sep 24

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demo
CVE-2024-48910 CRITICAL
9.8 Oct 31

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated critical severity (CVSS
CVE-2026-65914 MEDIUM POC
5.3 Jul 23

Mutation-XSS in DOMPurify before 3.3.2 enables JavaScript execution in victim browsers when sanitized output is re-inser
CVE-2026-65902 MEDIUM POC
5.3 Jul 23

Hook mutation pollution in DOMPurify <= 3.4.5 allows persistent bypass of HTML sanitization defaults when application-in
CVE-2026-65899 MEDIUM POC
5.1 Jul 23

Trusted Types policy state contamination in DOMPurify 3.0.0-3.4.8 allows a previously supplied TRUSTED_TYPES_POLICY to s
CVE-2026-65913 MEDIUM POC
5.1 Jul 23

Prototype pollution in DOMPurify's USE_PROFILES mode enables DOM-based XSS by causing the sanitizer to accept event hand
CVE-2026-65900 MEDIUM POC
5.1 Jul 23

SAFE_FOR_TEMPLATES bypass in DOMPurify 3.0.0-3.4.7 allows template expressions such as ${evil}, {{evil}}, and <%evil%> t
CVE-2026-65901 MEDIUM POC
5.1 Jul 23

Cross-site scripting in DOMPurify 3.4.6 and earlier enables script execution when the library's IN_PLACE sanitization mo
CVE-2026-65898 MEDIUM POC
5.1 Jul 23

Stored XSS is achievable in applications using DOMPurify's setConfig() API combined with an uponSanitizeAttribute hook t
CVE-2025-26791 MEDIUM POC
4.5 Feb 14

DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site sc

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Module for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise Server for SAP applications 16.0 Affected

Share

CVE-2026-65912 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy