CVE-2026-65898: DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig

Analyzed

AliasesUBUNTU-CVE-2026-65898DEBIAN-CVE-2026-65898CGA-5w9m-j9q9-68qf+175 more

Published 23-07-2026Last modified 23-07-2026

Vulnerability summary

CVE-2026-65898 is a high (CVSS 7.2) vulnerability in cure53 dompurify. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 11.5% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 5.1, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.2/10

010

High · v3.1 (CVE.org)

EPSS score

0.21%

0%100%

Low · -0.09 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1github

Advisory lineage

Upstream 0 · Downstream 3 · Related 2

OPENSUSE-SU-2026:11723-1 RHSA-2026:58500 RHSA-2026:58502 CGA-CG8P-7XP5-JGF3

Timeline

23-07-2026
PublishedVulnerability first disclosed.
23-07-2026
Last modifiedVulnerability information updated.

Description

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.

CVSS metrics

10 scores · 7 sources · 2 versions

v4.05.1v3.17.2

EPSS trend

Probability

0.21%

Chance of exploitation in the next 30 days

Percentile

12%

Versus all other CVEs

30-day change

Decrease -0.09 pp

From 0.30% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

githubUnverified
Dompurify
Maturity: poc

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard81 products

airflow-2All versions (No fix recorded)
airflow-core-2All versions (No fix recorded)
gitlab-rails-ce-18.1All versions (No fix recorded)
gitlab-rails-ce-18.10All versions (No fix recorded)
gitlab-rails-ce-18.11All versions (No fix recorded) | < 18.11.13-r0

gitlab-rails-ce-18.5All versions (No fix recorded)
gitlab-rails-ce-18.6All versions (No fix recorded)
gitlab-rails-ce-18.7All versions (No fix recorded)
gitlab-rails-ce-18.8All versions (No fix recorded)
gitlab-rails-ce-18.9All versions (No fix recorded)
gitlab-rails-ce-19.0All versions (No fix recorded) | < 19.0.10-r0
gitlab-rails-ce-19.1< 19.1.7-r6
gitlab-rails-ce-fips-18.1All versions (No fix recorded)
gitlab-rails-ce-fips-18.10< 18.10.8-r8
gitlab-rails-ce-fips-18.11< 18.11.12-r2
gitlab-rails-ce-fips-18.5All versions (No fix recorded)
gitlab-rails-ce-fips-18.6All versions (No fix recorded)
gitlab-rails-ce-fips-18.7All versions (No fix recorded)
gitlab-rails-ce-fips-18.8All versions (No fix recorded)
gitlab-rails-ce-fips-18.9< 18.9.8-r8
gitlab-rails-ce-fips-19.0< 19.0.9-r3
gitlab-rails-ce-fips-19.1< 19.1.7-r7
kibana-9.4< 9.4.2-r6
kibana-9.4-iamguarded< 9.4.2-r6
langfuse-2< 2.95.12-r31
langfuse-2-worker< 2.95.12-r31
langfuse-3-compat< 3.225.7-r6
langfuse-3-worker< 3.197.1-r0
langfuse-fips-2< 2.95.12-r33
langfuse-fips-2-worker< 2.95.12-r33
langfuse-fips-3-worker< 3.197.0-r0
librechat< 0.8.7-r4
nextcloud-server-31All versions (No fix recorded)
nextcloud-server-32< 32.0.12-r4
nextcloud-server-33< 33.0.6-r5
nextcloud-server-34< 34.0.1-r4
opensearch-dashboards-2< 2.19.5-r15
opensearch-dashboards-2-alerting-dashboards-plugin< 2.19.5-r15
opensearch-dashboards-2-anomaly-detection-dashboards-plugin< 2.19.5-r15
opensearch-dashboards-2-dashboards-maps< 2.19.5-r15
opensearch-dashboards-2-dashboards-notifications< 2.19.5-r15
opensearch-dashboards-2-dashboards-observability< 2.19.5-r15
opensearch-dashboards-2-dashboards-query-workbench< 2.19.5-r15
opensearch-dashboards-2-dashboards-reporting< 2.19.5-r15
opensearch-dashboards-2-dashboards-search-relevance< 2.19.5-r15
opensearch-dashboards-2-dashboards-visualizations< 2.19.5-r15
opensearch-dashboards-2-index-management-dashboards-plugin< 2.19.5-r15
opensearch-dashboards-2-ml-commons-dashboards< 2.19.5-r15
opensearch-dashboards-2-security-analytics-dashboards-plugin< 2.19.5-r15
opensearch-dashboards-2-security-dashboards-plugin< 2.19.5-r15
opensearch-dashboards-3-fips< 3.7.0-r0
opensearch-dashboards-3-fips-alerting-dashboards-plugin< 3.7.0-r0
opensearch-dashboards-3-fips-anomaly-detection-dashboards-plugin< 3.7.0-r0
opensearch-dashboards-3-fips-dashboards-maps< 3.7.0-r0
opensearch-dashboards-3-fips-dashboards-notifications< 3.7.0-r0
opensearch-dashboards-3-fips-dashboards-observability< 3.7.0-r0
opensearch-dashboards-3-fips-dashboards-query-workbench< 3.7.0-r0
opensearch-dashboards-3-fips-dashboards-reporting< 3.7.0-r0
opensearch-dashboards-3-fips-dashboards-search-relevance< 3.7.0-r0
opensearch-dashboards-3-fips-index-management-dashboards-plugin< 3.7.0-r0
opensearch-dashboards-3-fips-ml-commons-dashboards< 3.7.0-r0
opensearch-dashboards-3-fips-security-analytics-dashboards-plugin< 3.7.0-r0
opensearch-dashboards-3-fips-security-dashboards-plugin< 3.7.0-r0
wazuh-dashboard< 4.14.5-r7
wazuh-dashboard-alerting-dashboards-plugin< 4.14.5-r7
wazuh-dashboard-alerting-dashboards-plugin-fips< 4.14.5-r7
wazuh-dashboard-anomaly-detection-dashboards-plugin< 4.14.5-r7
wazuh-dashboard-anomaly-detection-dashboards-plugin-fips< 4.14.5-r7
wazuh-dashboard-dashboards-maps< 4.14.5-r7
wazuh-dashboard-dashboards-maps-fips< 4.14.5-r7
wazuh-dashboard-dashboards-notifications< 4.14.5-r7
wazuh-dashboard-dashboards-notifications-fips< 4.14.5-r7
wazuh-dashboard-dashboards-reporting< 4.14.5-r7
wazuh-dashboard-dashboards-reporting-fips< 4.14.5-r7
wazuh-dashboard-dashboards-visualizations< 4.14.5-r7
wazuh-dashboard-dashboards-visualizations-fips< 4.14.5-r7
wazuh-dashboard-fips< 4.14.5-r7
wazuh-dashboard-index-management-dashboards-plugin< 4.14.5-r7
wazuh-dashboard-index-management-dashboards-plugin-fips< 4.14.5-r7
wazuh-dashboard-plugins< 4.14.5-r7
wazuh-dashboard-plugins-fips< 4.14.5-r7

Show all 81

Wolfi4 products

langfuse-3-compat< 3.225.7-r6
langfuse-3-worker< 3.197.1-r0
nextcloud-server-32< 32.0.12-r4
nextcloud-server-33< 33.0.6-r5

Cure531 product

dompurify< 3.4.11

Debian1 product

node-dompurifyAll versions (No fix recorded) | < 3.4.12+dfsg-1

Npm1 product

dompurify< 3.4.11

Ubuntu1 product

node-dompurifyAll versions (No fix recorded)

6 vendors · 89 products

References

11 links

github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882Vendor AdvisoryREPORTAdvisoryWEBExploitThird Party Advisory
www.vulncheck.com/advisories/dompurify-before-permanent-attribute-allowlist-pollution-via-setconfigThird Party AdvisoryAdvisory
ubuntu.com/security/CVE-2026-65898REPORT
www.cve.org/CVERecord?id=CVE-2026-65898REPORT
security-tracker.debian.org/tracker/CVE-2026-65898Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65898.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-65898Advisory
github.com/cure53/DOMPurify/pull/1482WEB
github.com/cure53/DOMPurify/commit/011bc3b2fcc4be17aa76f9030e8668207717acb9WEB
github.com/cure53/DOMPurifyPACKAGE

Show all 11 references

github.com/cure53/DOMPurify/releases/tag/3.4.11WEB