CVE-2026-65913 in DOMPurify
Summary
by MITRE • 07/23/2026
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
DOMPurify versions prior to 3.3.2 contain a critical prototype pollution vulnerability that fundamentally compromises the security guarantees of the library when operating in USE_PROFILES mode. This vulnerability stems from improper handling of prototype properties during attribute filtering operations, specifically affecting Array.prototype properties that are commonly used for event handler management. The flaw allows attackers to manipulate the prototype chain by setting properties such as onclick to boolean true values, which subsequently influences how DOMPurify evaluates and sanitizes HTML attributes.
The technical implementation of this vulnerability exploits the core design of JavaScript's prototype inheritance system where modifications to Array.prototype affect all arrays in the execution environment. When DOMPurify processes markup in USE_PROFILES mode, it performs attribute filtering by examining properties that may be inherited from prototypes rather than strictly checking the object's own properties. This creates a condition where attacker-controlled values can pollute the prototype chain with malicious attributes that bypass normal sanitization checks.
The operational impact of this vulnerability extends beyond simple bypass of security controls to enable full DOM-based cross-site scripting attacks. When sanitized markup containing polluted prototype attributes is rendered in browsers, the malicious event handlers become active and executable, allowing attackers to inject arbitrary JavaScript code into web applications. This represents a severe escalation from mere attribute filtering bypass to complete code execution within the context of the user's session.
Security professionals should immediately upgrade to DOMPurify version 3.3.2 or later, which implements proper prototype pollution safeguards in USE_PROFILES mode. Additional mitigations include implementing strict Content Security Policy headers, avoiding USE_PROFILES mode when possible, and conducting thorough security reviews of all HTML sanitization processes. This vulnerability aligns with CWE-471, which describes the improper handling of prototype pollution, and maps to ATT&CK technique T1203, specifically targeting the exploitation of web application vulnerabilities through prototype manipulation attacks. The flaw demonstrates how seemingly benign library features can introduce critical security weaknesses when not properly secured against prototype-based attack vectors.