Prototype Pollution Vulnerability in DOMPurify Affects Developers Using This Library

CVE-2026-65913

What is CVE-2026-65913?

DOMPurify versions earlier than 3.3.2 possess a prototype pollution vulnerability within the USE_PROFILES mode. This flaw allows attackers to manipulate Array.prototype properties, such as setting onclick to true. Consequently, this manipulation enables the acceptance of event handlers as allowed attributes during the sanitization process, potentially leading to DOM-based cross-site scripting (XSS) when rendered. Developers using DOMPurify must upgrade to version 3.3.2 or later to mitigate this vulnerability and ensure the security of their web applications.

References