DOMPurify CVE-2026-65912

Exploitation requires the target application to have explicitly configured DOMPurify with a predicate function supplied as ADD_ATTR via EXTRA_ELEMENT_HANDLING.attributeCheck, and that predicate must return true for a URI-bearing attribute (such as href on <a> elements) in response to attacker-controlled input. Applications using DOMPurify without the EXTRA_ELEMENT_HANDLING.attributeCheck API - the vast majority of deployments - are not affected by this vulnerability. Additionally, exploitation requires user interaction: the CVSS 4.0 vector (UI:A) confirms the victim must actively click or activate the crafted link for the javascript: payload to execute. These two prerequisites - non-default API configuration and required user interaction - are the primary factors limiting real-world exploitation beyond the high theoretical reach of the library.

The CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) accurately captures the network-accessible delivery and user-interaction requirement (victim must click the link), with impact scoped to the subsequent system (victim browser context) rather than the vulnerable application's own data. The key real-world risk limiter is the non-default configuration: only applications that explicitly pass a permissive predicate function to EXTRA_ELEMENT_HANDLING.attributeCheck are exposed - standard DOMPurify usage without this API is unaffected. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified from that signal. No CISA KEV listing exists, indicating no confirmed widespread active exploitation. However, a working PoC is documented in the official GHSA advisory, meaningfully lowering the exploitation bar for targeted scenarios. Given DOMPurify's enormous npm footprint, even a small percentage of misconfigured deployments represents a substantial absolute attack surface.

An attacker targets a web application that renders user-supplied HTML through DOMPurify configured with a custom ADD_ATTR predicate that returns true for href on anchor elements. The attacker submits <a href="javascript:alert(document.domain)">click here</a>, which passes sanitization because _isValidAttribute exits before URI validation when the predicate approves the attribute. When a victim user clicks the rendered link, the javascript: payload executes in the victim's browser context; the GHSA-published PoC demonstrates this technique using an iframe click to simulate victim interaction.