CVE-2026-65898 in DOMPurify
Summary
by MITRE • 07/23/2026
DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability in DOMPurify versions prior to 3.4.11 represents a critical flaw in the library's configuration management system that enables persistent cross-site scripting attacks through improper attribute allowlist handling. The core issue stems from how the library manages its internal ALLOWED_ATTR collection when the setConfig() method is invoked alongside an uponSanitizeAttribute hook. When these two features are used together, the sanitization process fails to create a proper clone of the allowed attributes configuration, instead maintaining a shared reference to the original allowlist array.
The technical exploitation occurs through a carefully crafted hook registration that can modify the shared allowlist in memory. Attackers can register an uponSanitizeAttribute hook that conditionally permits dangerous attributes such as onerror or onclick for specific trusted elements while maintaining the appearance of normal sanitization behavior. This hook execution modifies the global ALLOWED_ATTR array directly, creating a persistent mutation that affects all subsequent sanitization operations within the same JavaScript context. The vulnerability leverages the fact that DOMPurify does not perform deep cloning of its internal configuration objects when setConfig() is called with hooks, leading to what cybersecurity researchers classify as a configuration-based privilege escalation within the sanitization framework.
The operational impact of this vulnerability extends beyond simple XSS exploitation, as it creates a persistent security weakness that can be leveraged across multiple request contexts within the same application session. Once an attacker successfully registers their malicious hook and triggers the polluted allowlist condition, any subsequent untrusted content processed by DOMPurify will inherit the compromised attribute permissions. This allows for stored cross-site scripting attacks where attackers can inject malicious event handlers into HTML content that gets sanitized and subsequently rendered in the browser. The vulnerability is particularly dangerous because it operates silently within the sanitization process without raising immediate alarms, making detection challenging for security monitoring systems.
This specific flaw aligns with CWE-358 weakness classification related to Security-relevant Configuration, while also mapping to ATT&CK technique T1071.004 for application layer protocol and T1203 for Exploitation for Client Execution. The vulnerability demonstrates how improper configuration management can create persistent security flaws that affect the core sanitization capabilities of a security library. Organizations using DOMPurify in their web applications face significant risk from this issue, as it essentially allows attackers to bypass the intended security controls of the library itself. The recommended mitigation involves updating to DOMPurify version 3.4.11 or later, where the library properly implements deep cloning of the ALLOWED_ATTR configuration when setConfig() is used with uponSanitizeAttribute hooks, ensuring that hook modifications do not persistently affect the global sanitization rules and maintain the integrity of the security boundaries established by the library's core functionality.