CVE-2026-65902 cure53 CVE debrief

Who should care

Developers and administrators using DOMPurify in their applications, especially those handling user-input data, should be aware of this vulnerability and take necessary actions to mitigate it. This includes reviewing the library's usage in their applications, assessing the potential impact, and applying patches or mitigations as necessary. Additionally, security teams and vulnerability management teams should be aware of this vulnerability and prioritize its remediation based on the severity and potential impact on their systems and applications.

Technical summary

DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitize calls inherit the widened defaults and attacker payloads using the poisoned tag/attribute name survive sanitization. The vulnerability can be mitigated by upgrading to DOMPurify version 3.4.7 or later. The issue is a result of the library's design and the way it handles hooks, which can be exploited by attackers to bypass security mechanisms.

Defensive priority

Medium-severity vulnerability in DOMPurify, a popular JavaScript library for sanitizing HTML and preventing XSS attacks. Successful exploitation requires user interaction.

Recommended defensive actions

• Apply patches: Upgrade DOMPurify to version 3.4.7 or later.
• Implement compensating controls: Use a Web Application Firewall (WAF) to detect and prevent potential attacks.
• Inventory and monitor: Check for and monitor usage of affected DOMPurify versions in your applications.
• Review library usage: Verify if DOMPurify is used in your applications and assess the potential impact of the vulnerability.
• Asset inventory: Identify systems and applications that use the affected DOMPurify versions.
• Source tracking: Monitor for any updates or patches from the library maintainers and apply them as necessary.
• Exposure review: Assess the potential exposure of your systems and applications to this vulnerability.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. DOMPurify before 3.4.7 is affected by an issue where hooks can mutate allowedTags and allowedAttributes fields, potentially leading to security bypass. Evidence is limited to public sources, and defenders should verify the vulnerability's impact on their systems. Additional verification tasks include reviewing the library's usage in applications and checking for any existing mitigations.

Official resources