DOMPurify Hook Mutation Vulnerability in Cure53 Product
CVE-2026-65902
5.3MEDIUM
What is CVE-2026-65902?
A vulnerability in DOMPurify prior to version 3.4.7 permits manipulation through the data.allowedTags and data.allowedAttributes arguments, allowing malicious actors to extend the permitted tag and attribute lists unexpectedly. When the sanitize method is invoked without configured allowed tags or attributes, inherited and mutated hook configurations can lead to payloads bypassing sanitization. This issue persists, as attempts to revert the configuration through removeAllHooks() or clearConfig() do not restore the initial state, necessitating the instantiation of a new DOMPurify instance to ensure secure sanitization.
Affected Version(s)
DOMPurify 0 < 3.4.7
DOMPurify 3.4.7