CVE-2026-65911 cure53 CVE debrief

Who should care

Developers and security teams using DOMPurify versions before 3.4.0 should prioritize patching to prevent potential cross-site scripting attacks. This includes reviewing and updating code that uses DOMPurify.sanitize() with ADD_ATTR or ADD_TAGS, and implementing additional security measures to detect and prevent cross-site scripting attacks. Affected operators, platforms, and security teams should be aware of the vulnerability and its potential impact. They should also review compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

CVE-2026-65911 is a cross-site scripting vulnerability in DOMPurify through 3.3.3. Function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, allowing dangerous event-handler attributes or forbidden tags to survive sanitization.

Defensive priority

Medium priority given the CVSS score of 5.1 and the potential for cross-site scripting attacks. Organizations should prioritize patching to prevent potential cross-site scripting attacks, especially in environments where DOMPurify is used to sanitize user input. Review and update code using DOMPurify.sanitize() with ADD_ATTR or ADD_TAGS, and implement additional security measures to detect and prevent cross-site scripting attacks. Consider compensating controls for exposed systems while remediation is scheduled and verified. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented. The priority is medium due to the potential impact, but it may vary depending on the specific use case and environment. For high-risk environments, consider immediate action to patch or mitigate the vulnerability. In addition, ensure that security teams are aware of the vulnerability and its potential impact on the organization. The defensive priority is also influenced by the fact that the vendor considers this an edge case outside DOMPurify's threat model, which might affect the urgency of the patching process. However, given the potential for cross-site scripting attacks, a proactive approach to patching and mitigation is recommended. The CVSS score of 5.1 indicates a medium severity, but the actual impact may vary depending on the specific use case and environment. Therefore, a thorough review of the vulnerability and its potential impact is necessary to determine the appropriate defensive priority. The medium priority also reflects the need for a balanced approach between security and operational considerations. While patching is recommended, it should be done in a controlled manner to minimize disruptions to critical systems and services. In summary, the defensive priority is medium, but it should be adjusted based on the specific use case, environment, and organizational risk tolerance. A medium priority indicates that patching should be prioritized, but it should be done in a controlled manner to minimize disruptions. The priority is also influenced

Recommended defensive actions

• Patch DOMPurify to version 3.4.0 or later
• Review and update code using DOMPurify.sanitize() with ADD_ATTR or ADD_TAGS
• Implement additional security measures to detect and prevent cross-site scripting attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. The vendor considers this an edge case outside DOMPurify's threat model. Limited information is available on affected scope and vendor remediation efforts. Additional review is needed to understand the full impact and to verify the accuracy of the information provided. Further investigation may be required to determine the extent of the vulnerability and potential mitigations.

Official resources