CVE-2026-65911 in DOMPurify
Summary
by MITRE • 07/23/2026
In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can allow dangerous event-handler attributes or forbidden tags (bypassing FORBID_TAGS) to survive sanitization, resulting in cross-site scripting. The vendor (Cure53) considers this an edge case outside DOMPurify's threat model; the referenced advisory lists 3.4.0 as the patched version.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/23/2026
The vulnerability in DOMPurify versions 3.3.3 and earlier represents a critical state management issue that undermines the security guarantees of the library's sanitization process. This flaw stems from improper handling of internal state variables within the sanitize function, specifically the EXTRA_ELEMENT_HANDLING mechanism that stores custom attribute and tag predicates. When developers configure DOMPurify with ADD_ATTR or ADD_TAGS parameters containing function handlers, these functions become permanently embedded in the library's internal state structure. The persistence of these function handlers across multiple sanitize() calls creates a dangerous scenario where previously configured functional predicates continue to influence subsequent sanitization operations even when new parameters are provided.
The technical implementation of this vulnerability exploits the lack of proper state cleanup mechanisms within DOMPurify's core processing logic. When a developer initially calls sanitize() with ADD_ATTR or ADD_TAGS as functions, these handlers are stored in memory and remain active for all future calls to the same instance. The issue becomes particularly problematic when subsequent calls use array-based parameters instead of function handlers, as the system fails to properly clear or overwrite the existing functional predicates. This creates a state inconsistency where the library's behavior becomes unpredictable and potentially insecure, since legacy function handlers continue to operate even when they should be replaced or cleared.
The operational impact of this vulnerability is severe and directly enables cross-site scripting attacks by allowing malicious input to bypass intended security restrictions. Attackers can leverage this flaw to inject dangerous event handler attributes such as onclick, onmouseover, or other JavaScript event handlers that would normally be rejected by the sanitization process. Additionally, forbidden tags specified in FORBID_TAGS can be circumvented when they are part of the original function-based predicate definitions, effectively neutralizing the intended protection mechanisms. This vulnerability particularly affects web applications that rely heavily on DOMPurify for sanitizing user-generated content, potentially leading to full compromise of user sessions and data exfiltration.
This vulnerability aligns with CWE-691, which addresses insufficient control of code generation or execution, and can be categorized under ATT&CK technique T1203, which involves exploiting weaknesses in input validation. The flaw demonstrates poor state management practices that violate fundamental security principles regarding the isolation and proper cleanup of functional components within security libraries. The vendor's classification of this as an edge case despite its potential for XSS exploitation highlights a critical gap in threat modeling and security testing. The fact that version 3.4.0 specifically addresses this issue through proper state clearing mechanisms demonstrates the importance of maintaining clean internal state management in security-critical libraries. Organizations using affected versions should immediately upgrade to version 3.4.0 or later, while also implementing additional validation layers and monitoring for any unusual behavior patterns that might indicate exploitation attempts.