Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
Funny... I hadn't realised a second CVE for DOMPurify had been assigned for the work I undertook a few months ago. There was me thinking I had just one DOMPurify CVE when I had two all along. https://www.cve.org/CVERecord?id=CVE-2026-65898 https://labs.trace37.com/cves/cve-2026-65898/ https://t.co/JZWpKNPnOz
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | cure53 | dompurify | - | - | - |