CVE-2026-65898
Undergoing Analysis Undergoing Analysis - In Progress

DOMCloning Flaw in DOMPurify Enables Stored XSS

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description
DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-65898
EUVD
EUVD-2026-48286

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cure53 dompurify to 3.4.11 (exc)
clearlove dompurify to 3.4.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook. This allows the hook to permanently modify the shared allowlist. Attackers can register a hook that conditionally permits dangerous attributes like onerror for trusted elements. When untrusted content is processed, it inherits the polluted allowlist, enabling stored XSS attacks.

Detection Guidance

Check if your DOMPurify version is below 3.4.11. Use commands like npm list dompurify or grep for version in package.json to verify. Inspect code for setConfig usage with uponSanitizeAttribute hooks that modify allowedAttributes.

Impact Analysis

This vulnerability allows attackers to execute malicious JavaScript code in a victim's browser through stored XSS. It can lead to unauthorized data access, session hijacking, or defacement of websites. Applications using DOMPurify versions before 3.4.11 with setConfig() and uponSanitizeAttribute hooks are at risk.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face fines, legal liabilities, and reputational damage if exploited. Compliance with these regulations requires preventing unauthorized code execution.

Mitigation Strategies

Upgrade DOMPurify to version 3.4.11 or later. If upgrading is not possible, avoid using setConfig with uponSanitizeAttribute hooks. Use clearConfig between trust domains or separate DOMPurify instances for trusted and untrusted content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65898. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart