CVE-2026-65902
Undergoing Analysis Undergoing Analysis - In Progress

DOM Clobbering via Hooked DOMPurify Sanitization

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description
DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitize calls inherit the widened defaults and attacker payloads using the poisoned tag/attribute name survive sanitization. removeAllHooks(), clearConfig(), and passing a fresh cfg do not recover the state; only constructing a new DOMPurify instance does.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-65902
EUVD
EUVD-2026-48271

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cure53 dompurify to 3.4.7 (exc)
dompurify dompurify to 3.4.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-501 The product mixes trusted and untrusted data in the same data structure or structured message.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

DOMPurify before 3.4.7 passes direct references to default allowed tags and attributes to hooks when sanitize is called without explicit configuration. If a hook mutates these references, it permanently widens the default allow-lists for the entire DOMPurify instance. This allows attacker payloads to bypass sanitization in all subsequent calls using default settings.

Detection Guidance

To detect this vulnerability, check the installed version of DOMPurify. If it is less than 3.4.7, the system is vulnerable. Run: npm list dompurify or grep "dompurify" package.json to verify the version.

Impact Analysis

Attackers can inject malicious tags or attributes that survive sanitization, potentially leading to XSS attacks or other code execution. The vulnerability persists even after hook removal or config clearing, requiring a full DOMPurify instance restart to reset.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification if exploited, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information.

Mitigation Strategies

Upgrade DOMPurify to version 3.4.7 or later. Review and remove any hooks that modify allowedTags or allowedAttributes. Avoid using default sanitization without explicit cfg.ALLOWED_TAGS or cfg.ALLOWED_ATTR.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65902. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart