PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-65913 cure53 CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-23T14:18:06.573Z and has not been modified since then. The NVD entry is currently Analyzed. This medium-severity vulnerability in DOMPurify before version 3.3.2 is a prototype pollution vulnerability in USE_PROFILES mode, allowing attackers to bypass attribute filtering by polluting Array.prototype properties. This can result in DOM-based XSS when sanitized markup is rendered. The vulnerability has a CVSS score of 5.1 and is classified as CWE-1321. Affected product deployments should be identified in managed environments and assigned an owner for follow-up. Official advisories or CVE records should be reviewed to validate affected scope, severity, and vendor guidance. Vendor-supported updates or mitigations should be planned through normal change control where exposure is confirmed. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Relevant monitoring, detection, and logs should be checked for exposed assets that need extra review. Exceptions should be tracked, remediated assets should be retested, and the item should only be closed after evidence is documented.

Vendor
cure53
Product
DOMPurify
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-23
Original CVE updated
2026-07-28
Advisory published
2026-07-23
Advisory updated
2026-07-28

Who should care

Developers and security teams using DOMPurify versions before 3.3.2 should be aware of this vulnerability and take steps to mitigate it. Additionally, security teams monitoring for DOM-based XSS attacks and prototype pollution vulnerabilities should be aware of this issue.

Technical summary

CVE-2026-65913 is a medium-severity vulnerability in DOMPurify before version 3.3.2. The issue is a prototype pollution vulnerability in USE_PROFILES mode, allowing attackers to bypass attribute filtering by polluting Array.prototype properties. This can result in DOM-based XSS when sanitized markup is rendered. The vulnerability has a CVSS score of 5.1 and is classified as CWE-1321. Limited evidence suggests attackers can set Array.prototype properties to true, causing DOMPurify to accept event handlers as allowlisted attributes, resulting in DOM-based XSS when sanitized markup is rendered. Further verification is needed to fully understand the vulnerability's impact and exploitation. Affected product context and defensive impact should be added to existing security policies and procedures. Additional sanitization or validation to user-input data should be considered.

Defensive priority

Medium-severity DOM-based XSS vulnerability in DOMPurify via prototype pollution

Recommended defensive actions

  • Inventory and verify DOMPurify version, checking for 3.3.2 or later
  • Implement compensating controls, such as Web Application Firewalls (WAFs) or Intrusion Detection Systems (IDS)
  • Monitor for suspicious activity, particularly event handlers and attribute filtering
  • Consider applying additional sanitization or validation to user-input data
  • Review and update existing security policies and procedures

Evidence notes

The CVE-2026-65913 record indicates a medium-severity vulnerability in DOMPurify before version 3.3.2. The issue is a prototype pollution vulnerability in USE_PROFILES mode, allowing attackers to bypass attribute filtering. Limited evidence suggests attackers can set Array.prototype properties to true, causing DOMPurify to accept event handlers as allowlisted attributes, resulting in DOM-based XSS when sanitized markup is rendered. Further verification is needed to fully understand the vulnerability's impact and exploitation.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-23T14:18:06.573Z and has not been modified since then.