CVE-2026-65903
Undergoing Analysis Undergoing Analysis - In Progress

DOM Purify Logic Error Bypasses Tag Restrictions

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description
DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-65903
EUVD
EUVD-2026-48272

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dompurify dompurify to 3.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-697 The product compares two entities in a security-relevant context, but the comparison is incorrect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

DOMPurify before version 3.4.0 has a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. When a tag is listed in both FORBID_TAGS and ADD_TAGS, the condition fails to check FORBID_TAGS properly, letting forbidden tags remain in sanitized output.

Detection Guidance

Check DOMPurify version with npm list dompurify or grep "version" in package.json. If version is below 3.4.0, the system is vulnerable. Inspect application code for use of ADD_TAGS and FORBID_TAGS functions.

Impact Analysis

This vulnerability allows attackers to inject forbidden HTML tags into sanitized content by crafting input that exploits the logic error. This could lead to XSS attacks, unauthorized script execution, or unintended HTML rendering in web applications using vulnerable DOMPurify versions.

Mitigation Strategies

Upgrade DOMPurify to version 3.4.0 or later. Review and update code to ensure FORBID_TAGS checks occur before ADD_TAGS logic. Test sanitization output to confirm forbidden tags are removed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65903. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart