Cross-Site Scripting Vulnerability in DOMPurify by Cure53

CVE-2026-65911

What is CVE-2026-65911?

The vulnerable version of DOMPurify (up to 3.3.3) exhibits a critical flaw where the function predicates supplied through ADD_ATTR or ADD_TAGS can persist across multiple sanitize() calls on the same instance. This persistence allows attacker-controlled attributes or tags to bypass sanitization checks, thereby enabling the injection of dangerous event-handler attributes or forbidden tags. Consequently, this creates a potential vector for cross-site scripting attacks, as the previously set function handlers are not properly cleared or replaced when new parameters are provided as arrays. Users are urged to upgrade to version 3.4.0 or higher to mitigate this issue.

References