CVE-2026-65912 in DOMPurify
Summary
by MITRE • 07/23/2026
DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe protocols like javascript: to survive sanitization and execute as DOM-based XSS when the link is activated.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
The vulnerability in DOMPurify versions prior to 3.3.2 represents a critical security flaw that undermines the library's core sanitization capabilities. This issue stems from improper handling of URI validation when custom attribute checks are enabled through the EXTRA_ELEMENT_HANDLING.attributeCheck predicate function. The flaw allows attackers to craft malicious inputs that bypass the intended security restrictions, potentially leading to persistent cross-site scripting attacks.
The technical implementation of this vulnerability exploits a specific code path where the ADD_ATTR functionality interacts with the EXTRA_ELEMENT_HANDLING configuration. When developers configure custom attribute validation through the attributeCheck predicate function, the sanitization process fails to properly validate URI schemes against the configured safe protocols. This occurs because the validation logic does not adequately consider the context in which attributes are processed, particularly when custom predicates are provided that accept specific tag-attribute combinations.
From an operational perspective, this vulnerability creates a significant risk for web applications that rely on DOMPurify for content sanitization. The bypass allows malicious javascript: URIs and other unsafe protocols to pass through the sanitization process undetected, making them executable when users interact with the affected content. This particular attack vector is particularly dangerous because it leverages legitimate DOM-based XSS techniques while appearing to use standard attribute handling mechanisms.
The impact of this vulnerability aligns with CWE-20 and CWE-79 classifications, representing both input validation failures and cross-site scripting vulnerabilities. Attackers can craft malicious HTML content that appears benign but contains hidden javascript payloads, which execute when users click on links or interact with the sanitized content. This type of attack falls under ATT&CK technique T1059.006 for command and control communication through scripting languages and T1203 for exploitation of web applications.
Organizations should immediately upgrade to DOMPurify version 3.3.2 or later to address this vulnerability, as the fix implements proper URI validation checks that account for custom attribute predicates. Additionally, security teams should review existing implementations to ensure no custom attribute validation logic has been introduced that might inadvertently create similar bypass opportunities. The recommended mitigation includes implementing strict input validation at multiple layers and maintaining regular security audits of third-party libraries to prevent similar issues from arising in the future.