DOMPurify Vulnerability in Allowlist Handling Affecting Cure53

CVE-2026-65898

What is CVE-2026-65898?

The issue arises when DOMPurify versions prior to 3.4.11 improperly handle the ALLOWED_ATTR allowlist during the setConfig() process, particularly when used with an uponSanitizeAttribute hook. This can lead to a scenario where an attacker can modify the shared allowlist to enable harmful attributes, such as onerror, for trusted elements. By submitting untrusted content that inherits this compromised allowlist, the attacker can execute malicious payloads through stored XSS attacks, thereby posing significant security risks to web applications relying on DOMPurify for data sanitization.

References