Skip to main content

DOMPurify CVE-2026-65913

| EUVDEUVD-2026-48276 MEDIUM
Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)
2026-07-23 VulnCheck
XSS Prototype Pollution Dompurify Suse Red Hat
5.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.7 MEDIUM

AC:H reflects the non-trivial prerequisite of a chained prototype pollution capability; UI:R for required user interaction to fire the event handler; S:C for DOM XSS scope change into victim browser session.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
SUSE
6.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Red Hat
6.1 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

4
Patch available
Jul 23, 2026 - 15:18 EUVD
Source Code Evidence Fetched
Jul 23, 2026 - 13:51 vuln.today
Analysis Generated
Jul 23, 2026 - 13:51 vuln.today
CVE Published
Jul 23, 2026 - 13:16 cve.org
MEDIUM 5.1

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 287 npm packages depend on dompurify (25 direct, 262 indirect)

Ecosystem-wide dependent count for version 3.3.2.

DescriptionCVE.org

DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.

AnalysisAI

Prototype pollution in DOMPurify's USE_PROFILES mode enables DOM-based XSS by causing the sanitizer to accept event handler attributes it should block. Versions up to and including 3.3.1 of the npm package rebuild ALLOWED_ATTR as a plain JavaScript array when USE_PROFILES is active, making attribute allowlist lookups traverse the prototype chain - so a polluted Array.prototype (e.g., Array.prototype.onclick = true) causes DOMPurify to silently pass through event handlers like onclick into sanitized output. A proof-of-concept is included in the vendor advisory GHSA-cj63-jhhr-wcxv; no CISA KEV listing has been identified, indicating no confirmed active exploitation at time of analysis.

Technical ContextAI

DOMPurify (CPE: cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*) is a widely-used client-side HTML sanitizer distributed as an npm package by cure53. CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes - Prototype Pollution) captures the root cause: when USE_PROFILES mode is enabled, DOMPurify discards its existing ALLOWED_ATTR set and reconstructs it as a plain JavaScript Array before populating it with the requested allowlists. Attribute filtering then uses property-style lookups on that array (ALLOWED_ATTR[lcName]), which in JavaScript traverses the prototype chain. Any property pre-set on Array.prototype - such as Array.prototype.onclick = true - therefore evaluates as truthy, making DOMPurify treat that event handler as an allowlisted attribute. This is a logic bypass rooted in JavaScript's prototype inheritance model, not a memory-safety defect. The vulnerability is confined to the USE_PROFILES code path; the default DOMPurify configuration is not affected.

RemediationAI

Upgrade DOMPurify to version 3.3.2 or later, which is the vendor-released patch confirmed by GHSA-cj63-jhhr-wcxv. If an immediate upgrade is not feasible, the most targeted workaround is to stop using USE_PROFILES mode and instead manually configure ALLOWED_TAGS and ALLOWED_ATTR as explicit sets - this eliminates the array-rebuild code path that introduces the polluted-prototype lookup. Note that this workaround requires careful manual allowlist maintenance to avoid regressing sanitization coverage. Additionally, audit the full application dependency tree for prototype pollution sources (e.g., lodash < 4.17.21, qs < 6.10.3, query-string with object parsing enabled) and remediate those independently, since this vulnerability is most dangerous when chained with a pollution entry point elsewhere. Relying solely on removing USE_PROFILES is insufficient if prototype pollution is achievable through other application vectors. Advisory references: https://github.com/cure53/DOMPurify/security/advisories/GHSA-cj63-jhhr-wcxv.

More in Prototype Pollution

View all
CVE-2026-34621 HIGH POC
8.6 Apr 11

Prototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
CVE-2024-56059 CRITICAL
9.8 Dec 18

Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
CVE-2020-28271 CRITICAL POC
9.8 Nov 12

Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
CVE-2023-38894 CRITICAL POC
9.8 Aug 16

A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
CVE-2024-24292 CRITICAL POC
9.8 Mar 28

A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
CVE-2023-26121 CRITICAL POC
10.0 Apr 11

All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
CVE-2021-23449 CRITICAL POC
10.0 Oct 18

This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
CVE-2024-39011 CRITICAL POC
9.8 Jul 30

Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
CVE-2024-38988 CRITICAL POC
9.8 Mar 28

alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
CVE-2025-57347 CRITICAL POC
9.8 Sep 24

A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
CVE-2025-57321 CRITICAL POC
9.8 Sep 24

A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all
CVE-2024-45435 CRITICAL POC
9.8 Aug 29

Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Rated critical severity (CVSS 9.8), this

Same weakness CWE-1321 – Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

View all
CVE-2026-34621 HIGH POC
8.6
CVE-2024-56059 CRITICAL
9.8
CVE-2020-28271 CRITICAL POC
9.8
CVE-2023-38894 CRITICAL POC
9.8
CVE-2024-24292 CRITICAL POC
9.8
CVE-2023-26121 CRITICAL POC
10.0
CVE-2021-23449 CRITICAL POC
10.0
CVE-2024-39011 CRITICAL POC
9.8

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Module for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise Server for SAP applications 16.0 Affected

Share

CVE-2026-65913 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy