CVE-2026-65903 in DOMPurify
Summary
by MITRE • 07/23/2026
DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
The vulnerability in DOMPurify versions prior to 3.4.0 represents a critical logic error within the ADD_TAGS function that fundamentally undermines the security model of the library. This flaw stems from improper short-circuit evaluation mechanisms that create a dangerous bypass condition where forbidden tags can evade sanitization restrictions. The issue occurs when attackers craft input containing tags that exist in both the FORBID_TAGS configuration and are simultaneously added through the ADD_TAGS function, allowing these malicious elements to persist in the sanitized output.
This vulnerability operates at the core of DOMPurify's tag handling logic and directly impacts the library's ability to maintain secure content sanitization. The short-circuit evaluation pattern fails to properly validate whether a tag added via ADD_TAGS should remain permitted when it conflicts with FORBID_TAGS restrictions, creating an unexpected behavior where security controls are effectively neutralized. The flaw demonstrates poor defensive programming practices that violate fundamental security principles of least privilege and proper access control enforcement.
From an operational standpoint, this vulnerability exposes applications using DOMPurify to potential cross-site scripting attacks and arbitrary code execution risks. Attackers can leverage this bypass to inject malicious HTML tags that would normally be filtered out, potentially leading to session hijacking, data theft, or full system compromise. The impact extends beyond simple XSS scenarios as the retained forbidden tags may contain dangerous attributes or nested elements that could escalate privileges within the application context.
The technical implementation error aligns with CWE-254 weakness category, specifically addressing security misconfigurations and improper input validation within security controls. This vulnerability also maps to ATT&CK technique T1068 which involves exploiting legitimate credentials, though in this case it's about bypassing security controls rather than credential theft. The flaw essentially creates a backdoor within the sanitization process itself, where the intended security boundary between allowed and forbidden content becomes meaningless.
Mitigation strategies should immediately involve upgrading to DOMPurify version 3.4.0 or later where the short-circuit evaluation logic has been properly corrected. Organizations should also implement additional input validation layers and regularly audit their content sanitization configurations to ensure no similar bypass conditions exist in other security libraries or custom implementations. Security teams must conduct thorough testing of sanitized outputs to verify that forbidden tags are properly removed even when they appear in both ADD_TAGS and FORBID_TAGS configurations.