CVE-2026-65898

DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig

At a glance

Severity: MEDIUM 5.1
EPSS: EPSS 0.21 % · percentile 11 (2026-10-27)
State: PUBLISHED
Published: 2026-07-23
Updated: 2026-07-23
Assigner: VulnCheck
NVD status: Analyzed

Description

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.

Scores

Version	Score	Vector	Scored by
CVSS 4.0	MEDIUM 5.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N	VulnCheck
CVSS 3.1	HIGH 7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	VulnCheck
CVSS 4.0	MEDIUM 5.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · disclosure@vulncheck.com (Secondary)
CVSS 3.1	HIGH 7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	NVD · disclosure@vulncheck.com (Secondary)

Weaknesses (CWE)

CWE-79

Advisories

GHSA-cmwh-pvxp-8882 — DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)

European references

ENISA EUVD · EUVD-2026-48286
GCVE · GCVE-0-2026-65898

CERT-FR advisories

CERTFR-2026-AVI-1366 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
CERTFR-2026-AVI-1291 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-1256 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-1165 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-1094 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-1067 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-1049 — Multiples vulnérabilités dans Oracle MySQL · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:* < 3.4.11

Affected products

Product	Versions
cure53 · DOMPurify	affected 0 < 3.4.11 ; unaffected 3.4.11

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD