CVE-2026-65898 cure53 CVE debrief

Who should care

Developers and administrators using DOMPurify versions prior to 3.4.11 should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and restricting the use of setConfig() and uponSanitizeAttribute hooks, as well as implementing Content Security Policy (CSP) to mitigate XSS attacks.

Technical summary

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook. This allows attackers to register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS. The vulnerability has a CVSS score of 5.1 and is classified as MEDIUM severity. Evidence is based on official CVE and NVD records, as well as advisories from Cure53 and Vulncheck. DOMPurify is a popular JavaScript library used for sanitizing HTML and preventing XSS attacks. The vulnerability can be mitigated by applying the patch or upgrading to DOMPurify version 3.4.11 or later, reviewing and restricting the use of setConfig() and uponSanitizeAttribute hooks, and implementing Content Security Policy (CSP) to mitigate XSS attacks. Additionally, monitoring for suspicious activity and updating DOMPurify regularly can help prevent exploitation of this vulnerability. The vulnerability affects DOMPurify versions prior to 3.4.11 and can be exploited by submitting untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS. The CVE record indicates that the vulnerability has not been modified since its publication on 2026-07-23T14:18:04.517Z. The NVD entry for the vulnerability is currently Analyzed, indicating that the vulnerability has been thoroughly reviewed and validated. The vulnerability can be addressed by applying the patch or upgrading to DOMPurify version 3.4.11 or later, which fixes the issue by properly cloning the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook. This ensures that the allowlist is not permanently mutated by the hook, preventing attackers from registering a hook that conditionally allows dangerous attributes. By taking these steps, developers and administrators can help prevent exploitation of this vulnerability and protect against stored XSS attacks. The vulnerability highlights the importance of keeping software up-to-date and following best practices for secure coding and vulnerability management. By prioritizing

Defensive priority

Medium-priority defensive actions are recommended due to the CVSS score of 5.1 and the potential for stored XSS attacks.

Recommended defensive actions

• Apply the patch or upgrade to DOMPurify version 3.4.11 or later
• Review and restrict the use of setConfig() and uponSanitizeAttribute hooks
• Implement Content Security Policy (CSP) to mitigate XSS attacks
• Monitor for suspicious activity and update DOMPurify regularly
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE-2026-65898 record indicates that DOMPurify before version 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook. This could allow attackers to register a hook that conditionally allows dangerous attributes, leading to stored XSS. Evidence is based on official CVE and NVD records, as well as advisories from Cure53 and Vulncheck.

Official resources