CVE-2026-65911
Undergoing Analysis Undergoing Analysis - In Progress

Persistent Predicate Handling in DOMPurify XSS Bypass

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description
In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can allow dangerous event-handler attributes or forbidden tags (bypassing FORBID_TAGS) to survive sanitization, resulting in cross-site scripting. The vendor (Cure53) considers this an edge case outside DOMPurify's threat model; the referenced advisory lists 3.4.0 as the patched version.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-65911
EUVD
EUVD-2026-48274

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
cure53 dompurify to 3.4.0 (exc)
cure53 dompurify From 3.0.0 (inc) to 3.4.0 (exc)
cure53 dompurify 3.4.0
cure53 dompurify From 3.0.0 (inc) to 3.3.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-65911 is a cross-site scripting (XSS) vulnerability in DOMPurify versions 3.3.3 and earlier. It occurs when function predicates are passed via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize(). These predicates persist in internal state across subsequent sanitize() calls on the same instance. If a later call uses ADD_ATTR or ADD_TAGS as an array instead of a function, the stale function handler remains active, approving dangerous attributes or tags that should have been blocked. This allows event handlers like onclick or forbidden tags like script to bypass sanitization.

Impact Analysis

This vulnerability can allow attackers to inject malicious scripts into web pages, leading to session hijacking, credential theft, or arbitrary user actions. It specifically enables XSS attacks by bypassing DOMPurify's sanitization, allowing dangerous event handlers or forbidden tags to execute in the browser.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using vulnerable DOMPurify versions may face compliance breaches if user data is compromised through XSS attacks.

Mitigation Strategies

Upgrade DOMPurify to version 3.4.0 or later to patch the state leakage issue in ADD_ATTR and ADD_TAGS handling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65911. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart