VYPR
← All advisories
High severity7.2NVD Advisory· Published Jul 23, 2026· Updated Jul 28, 2026

CVE-2026-65898

CVE-2026-65898

Description

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
dompurifynpm
< 3.4.113.4.11

Affected products

62

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.