Medium severity6.1NVD Advisory· Published Jul 23, 2026· Updated Jul 28, 2026
CVE-2026-65913
CVE-2026-65913
Description
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
dompurifynpm | < 3.3.2 | 3.3.2 |
Affected products
3Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-cj63-jhhr-wcxvghsaADVISORY
- github.com/cure53/DOMPurify/security/advisories/GHSA-cj63-jhhr-wcxvnvdThird Party AdvisoryWEB
- www.vulncheck.com/advisories/dompurify-before-prototype-pollution-via-use-profilesnvdThird Party Advisory
- github.com/cure53/DOMPurify/releases/tag/3.3.2ghsaWEB
News mentions
0No linked articles in our index yet.