Vulnerability Description
DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cure53 | Dompurify | < 3.4.11 |
Related Weaknesses (CWE)
References
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882ExploitThird Party Advisory
- https://www.vulncheck.com/advisories/dompurify-before-permanent-attribute-allowlThird Party Advisory
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882ExploitThird Party Advisory
FAQ
What is CVE-2026-65898?
CVE-2026-65898 is a vulnerability with a CVSS score of 7.2 (HIGH). DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers c...
How severe is CVE-2026-65898?
CVE-2026-65898 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-65898?
Check the references section above for vendor advisories and patch information. Affected products include: Cure53 Dompurify.