Policy State Contamination in DOMPurify Affects Trust Boundaries

CVE-2026-65899

What is CVE-2026-65899?

A vulnerability in DOMPurify versions 3.0.0 up to 3.4.8 allows for the retention of a previously set Trusted Types policy across different trust boundaries. When the clearConfig() method is invoked, the trusted type policy is not reset, which results in the potential for unsafe TrustedHTML objects to be returned, thus enabling unmonitored script execution. This critical flaw in handling Trusted Types can lead to major security vulnerabilities if not addressed, making it crucial for developers to ensure proper sanitization and policy management across their applications.

References