CVE-2026-66010 in DOMPurify
Summary
by MITRE • 07/24/2026
DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into innerHTML sinks, creating second-order XSS gadgets.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/24/2026
DOMPurify versions prior to 3.4.12 contain a critical security flaw in its sanitization process that undermines the protection of custom elements within web applications. The vulnerability stems from the improper execution of the afterSanitizeElements hook when processing custom elements that are explicitly allowed through the CUSTOM_ELEMENT_HANDLING.tagNameCheck configuration option. This configuration allows developers to whitelist specific custom element names while maintaining strict sanitization controls for other HTML components. However, the flaw creates a bypass condition where sensitive attributes intended for removal by the sanitization process can persist on these allowed custom elements.
The technical implementation of this vulnerability occurs at the hook execution phase of DOMPurify's processing pipeline. When custom elements are permitted through tagNameCheck, the afterSanitizeElements hook fails to properly validate or sanitize the attributes associated with these elements, even though the core sanitization rules would normally strip such attributes. This represents a direct violation of the principle of least privilege in security design where attribute filtering should be consistent across all element types regardless of their classification.
The operational impact of this vulnerability is severe for applications that rely on DOMPurify for HTML sanitization, particularly those implementing custom elements as part of their user interface components. Attackers can exploit this weakness by crafting malicious input containing sensitive attributes on allowed custom elements, which then persist through the sanitization process. When these elements are subsequently re-injected into innerHTML sinks or other vulnerable DOM manipulation points, they create second-order cross-site scripting vulnerabilities that can be leveraged for various malicious activities including session hijacking, data exfiltration, and privilege escalation attacks.
This vulnerability directly maps to CWE-79 Cross-Site Scripting and CWE-20 Improper Input Validation categories within the Common Weakness Enumeration framework. The flaw demonstrates characteristics of both input sanitization bypass and attribute filtering failure, making it particularly dangerous in applications that combine custom elements with dynamic content rendering. From an ATT&CK perspective, this vulnerability enables techniques categorized under T1566 Initial Access through malicious content injection and T1059 Command and Scripting Interpreter for executing malicious payloads within the victim's browser context.
Organizations using DOMPurify should immediately upgrade to version 3.4.12 or later where this vulnerability has been addressed through proper hook execution for custom elements. Additionally, security teams should conduct comprehensive code reviews to identify any instances where CUSTOM_ELEMENT_HANDLING.tagNameCheck is utilized, ensuring that attribute filtering policies are consistently applied across all element types. The remediation process should include thorough testing of custom element handling scenarios and validation of sanitization outputs against known attack patterns. System administrators should also monitor for potential exploitation attempts in application logs and implement additional layers of defense including content security policies and strict input validation at multiple points within the application architecture to mitigate the risk of successful exploitation through this vulnerability.