These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The CVE-2026-66010 vulnerability in DOMPurify arises from the failure to execute the afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck. This allows attackers to preserve sensitive attributes on custom elements, which can later be re-injected into innerHTML sinks, creating second-order XSS gadgets. Affected product deployments should be identified and patched o [truncated]
The DOMPurify library before version 3.3.2 contains a mutation-XSS vulnerability. This occurs when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper context during reparsing, reactivating dangerous markup with event handlers to e [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-23T14:18:06.573Z and has not been modified since then. The NVD entry is currently Analyzed. This medium-severity vulnerability in DOMPurify before version 3.3.2 is a prototype pollution vulnerability in USE_PROFILES mode, allowing attackers to bypass attribute filtering by polluting Array.prototype [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-23T14:18:06.417Z and has not been modified since then. DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinati [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-23T14:18:06.260Z and has not been modified since then. The NVD entry is currently Undergoing Analysis. This CVE-2026-65911 vulnerability affects DOMPurify through version 3.3.3, allowing function predicates supplied via ADD_ATTR or ADD_TAGS to persist in internal state across subsequent sanitize() c [truncated]
The CVE-2026-65903 vulnerability is a logic error in the ADD_TAGS function of DOMPurify before 3.4.0. This error allows forbidden tags to bypass FORBID_TAGS restrictions, potentially enabling attackers to craft input containing forbidden tags that are retained in sanitized output. The affected product is DOMPurify, a JavaScript library used for sanitizing HTML and preventing cross-site scripting (XSS) att [truncated]
The CVE-2026-65902 vulnerability affects DOMPurify, a popular JavaScript library used for sanitizing HTML and preventing XSS attacks. The issue arises from DOMPurify's handling of hooks that mutate the DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets, potentially widening the default allow-lists for the lifetime of the DOMPurify instance. This can lead to security bypass if an attacker payload uses the [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-23T14:18:05.000Z and has not been modified since then. The vulnerability exists in DOMPurify through 3.4.6 in IN_PLACE mode, where it trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobb [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-23T14:18:04.843Z and has not been modified since then. The NVD entry is currently Analyzed. DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${ [truncated]
DOMPurify 3.0.0 before 3.4.9 has a vulnerability where the retained Trusted Types policy is not reset when clearConfig() is called. This can cause a DOMPurify instance reused across trust boundaries to stay bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller requesting RETURN_TRUSTED_TYPE output may receive a TrustedHTML object created by the old (potentially unsafe) policy rather than a c [truncated]
DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook. This vulnerability allows attackers to register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS. The CVE record was published on 20 [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-14T21:17:02.560Z and has not been modified since then. DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.content, allowing attacker-controlled markup su [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-14T21:17:01.743Z and has not been modified since then. The NVD entry is currently Analyzed. DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled [truncated]
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branch [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-14T20:17:02.143Z and has not been modified since then. The NVD entry is currently Undergoing Analysis. This vulnerability affects DOMPurify, a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. The issue is fixed in version 3.4.5. Developers and users of DOMPurify, especially those u [truncated]