CVE-2026-65902

Aliases:UBUNTU-CVE-2026-65902DEBIAN-CVE-2026-65902GHSA-76mc-f452-cxcmCGA-2vr6-8v7h-5c26CGA-66f7-8mpr-392jCGA-7643-42rm-697cCGA-7v6r-9387-v9qmCGA-95q9-xf5v-xv2pCGA-pm3p-hv57-63chCGA-277v-wr75-ppvhCGA-28xf-q2q2-w9v2CGA-2cmq-4j8g-qfqgCGA-2rw9-9657-7rfjCGA-2x6j-pjf4-87wwCGA-323x-cccf-6w9gCGA-32f4-vmrj-5fjgCGA-32hf-7745-gcfrCGA-3566-85h3-rc8rCGA-36hj-99h2-hg3gCGA-3p8g-hvvf-995cCGA-44mj-27gp-mvxxCGA-4539-v646-r7xcCGA-4f93-mq8h-c657CGA-4grm-2ccm-52qxCGA-4jhf-x7w9-94rfCGA-4wgx-4rcj-qxmvCGA-522w-249p-5qx2CGA-5j2g-mqp8-xmm6CGA-5wcc-pmp2-336cCGA-633q-qwpr-m2mpCGA-64pp-5qrr-7j6fCGA-66gv-hq5h-x6hcCGA-6fr4-6crf-gp7rCGA-6gp6-hqrf-cv5qCGA-75v9-p79c-hg43CGA-762f-c79h-3h55CGA-7cvj-qcx8-jc48CGA-7q47-mghr-wxh4CGA-7r8m-w444-rmjpCGA-7xwx-5qrf-rm3fCGA-83g8-x353-68x9CGA-85m4-893v-9575CGA-85mj-fmq8-9h28CGA-8f4m-c638-2c55CGA-8f55-rmp9-j3pvCGA-8rc8-3mww-4f8mCGA-8x82-jg6j-7fwpCGA-95pj-6rv6-c947CGA-c872-8h4p-p2jpCGA-cp49-wxpv-5f5xCGA-cvjv-v8m4-xr3jCGA-cwcp-cg47-7j5cCGA-f378-fhcf-2wv7CGA-f6qf-xjq2-h8j5CGA-fj2m-qggw-wh49CGA-fm23-24wf-2r2mCGA-g24q-qx8f-p775CGA-g3f3-44x5-qmmqCGA-g6c4-5mfm-669mCGA-g6cm-vqxq-xwphCGA-g9w4-ch56-xf55CGA-gr6h-7vfq-83v9CGA-gr74-rrxv-h72mCGA-gv7w-cr3m-xx8qCGA-h3v7-9g8g-rjc6CGA-h6rm-m222-m42gCGA-h9rh-hf6h-rxgxCGA-hfv9-x2jr-chr8CGA-hpj2-ff23-9mq8CGA-hrgx-9fp2-qjwgCGA-j7rv-m628-gqfxCGA-j8wg-hh25-xcr8CGA-jhv8-28gh-fmh3CGA-jrxr-fxgf-wq49CGA-jxpp-xcj2-rp54CGA-m89h-pfcj-97gwCGA-mc99-hw3c-h6mgCGA-mm4w-75h5-79vjCGA-mpcq-3p47-f7f9CGA-mrvj-c6h6-pr74CGA-p3pw-mgfw-gpfcCGA-pc2w-p3fj-hq6wCGA-pm8j-3x5p-8rgcCGA-pqcx-x6j6-g2pwCGA-pw3c-vjx3-q3phCGA-q6x9-8c38-3jjwCGA-qgw8-7xgw-j87fCGA-qxh6-h3f3-p89rCGA-r5j3-2j88-crx5CGA-r85w-2hgc-v6vpCGA-rf9m-hfw2-h9r3CGA-rpg3-mwhr-j7m2CGA-v3rh-r43w-c6x3CGA-v7c6-568w-vv5cCGA-v836-m955-gg9pCGA-vgfg-cxw7-35q9CGA-vvqq-8vrv-rrm2CGA-w2ch-g8h5-7jxxCGA-w5vr-638c-5wmmCGA-w7xw-wgf2-xmj4CGA-w8q8-87xp-p4cvCGA-wcpm-gfwx-p68vCGA-wpmq-mvqm-4hmvCGA-wwfv-wjwr-f59jCGA-wxxf-38xj-69cpCGA-x38p-qx4r-3265CGA-x58p-3wgq-3w4rCGA-x9qf-3jr4-88h5CGA-xfcj-rch5-xv3qCGA-xfr6-m645-vwq7CGA-xm63-vghm-xp98CGA-xr87-3wx2-vjm8CGA-xvmm-frhf-6qjqCGA-x9mj-c599-5w26
Advisory lineage Upstream: 1 Downstream: 2
Analyzed
Published: 23 Jul 2026, 13:16
Last modified:24 Jul 2026, 21:35

Vulnerability Summary

Overall Risk (default)
medium
34/100
CVSS Score
6.1 MEDIUM
v3.1 (cve.org)
EPSS Score
0.24% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

23 Jul 2026, 13:16
Published
Vulnerability first disclosed
24 Jul 2026, 21:35
Last Modified
Vulnerability information updated

Description

DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitize calls inherit the widened defaults and attacker payloads using the poisoned tag/attribute name survive sanitization. removeAllHooks(), clearConfig(), and passing a fresh cfg do not recover the state; only constructing a new DOMPurify instance does.

CVSS Metrics

  • v4.0•MEDIUM•Score: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
  • v4.0•MEDIUM•Score: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v3.1•MEDIUM•Score: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.24%• Percentile: 15%

Techniques & Countermeasures

  • CWE-501•Trust Boundary Violation

    The product mixes trusted and untrusted data in the same data structure or structured message.

Affected Systems

  • chainguard•airflow-2

    all

  • chainguard•airflow-core-2

    all

  • chainguard•gitlab-rails-ce-18.1

    all

  • chainguard•gitlab-rails-ce-18.10

    all

  • chainguard•gitlab-rails-ce-18.11

    all

  • chainguard•gitlab-rails-ce-18.5

    all

  • chainguard•gitlab-rails-ce-18.6

    all

  • chainguard•gitlab-rails-ce-18.7

    all

  • chainguard•gitlab-rails-ce-18.8

    all

  • chainguard•gitlab-rails-ce-18.9

    all

  • chainguard•gitlab-rails-ce-19.0

    all

  • chainguard•gitlab-rails-ce-19.1

    all | < 19.1.7-r6

  • chainguard•gitlab-rails-ce-fips-18.1

    all

  • chainguard•gitlab-rails-ce-fips-18.10

    all

  • chainguard•gitlab-rails-ce-fips-18.11

    all

  • chainguard•gitlab-rails-ce-fips-18.5

    all

  • chainguard•gitlab-rails-ce-fips-18.6

    all

  • chainguard•gitlab-rails-ce-fips-18.7

    all

  • chainguard•gitlab-rails-ce-fips-18.8

    all

  • chainguard•gitlab-rails-ce-fips-18.9

    all

  • chainguard•gitlab-rails-ce-fips-19.0

    all

  • chainguard•gitlab-rails-ce-fips-19.1

    all | < 19.1.7-r7

  • chainguard•kibana-9.4

    < 9.4.2-r6

  • chainguard•kibana-9.4-iamguarded

    < 9.4.2-r6

  • chainguard•langfuse-3-compat

    < 3.225.7-r6

  • chainguard•langfuse-3-worker

    < 3.191.0-r0

  • chainguard•langfuse-fips-3-worker

    < 3.192.0-r0

  • chainguard•librechat

    < 0.8.7-r1

  • chainguard•nextcloud-server-31

    all

  • chainguard•nextcloud-server-32

    < 32.0.12-r0

  • chainguard•nextcloud-server-33

    < 33.0.6-r0

  • chainguard•nextcloud-server-34

    < 34.0.1-r4

  • chainguard•wazuh-dashboard

    < 4.14.5-r7

  • chainguard•wazuh-dashboard-alerting-dashboards-plugin

    < 4.14.5-r7

  • chainguard•wazuh-dashboard-alerting-dashboards-plugin-fips

    < 4.14.5-r7

  • chainguard•wazuh-dashboard-anomaly-detection-dashboards-plugin

    < 4.14.5-r7

  • chainguard•wazuh-dashboard-anomaly-detection-dashboards-plugin-fips

    < 4.14.5-r7

  • chainguard•wazuh-dashboard-dashboards-maps

    < 4.14.5-r7

  • chainguard•wazuh-dashboard-dashboards-maps-fips

    < 4.14.5-r7

  • chainguard•wazuh-dashboard-dashboards-notifications

    < 4.14.5-r7

  • chainguard•wazuh-dashboard-dashboards-notifications-fips

    < 4.14.5-r7

  • chainguard•wazuh-dashboard-dashboards-reporting

    < 4.14.5-r7

  • chainguard•wazuh-dashboard-dashboards-reporting-fips

    < 4.14.5-r7

  • chainguard•wazuh-dashboard-dashboards-visualizations

    < 4.14.5-r7

  • chainguard•wazuh-dashboard-dashboards-visualizations-fips

    < 4.14.5-r7

  • chainguard•wazuh-dashboard-fips

    < 4.14.5-r7

  • chainguard•wazuh-dashboard-index-management-dashboards-plugin

    < 4.14.5-r7

  • chainguard•wazuh-dashboard-index-management-dashboards-plugin-fips

    < 4.14.5-r7

  • chainguard•wazuh-dashboard-plugins

    < 4.14.5-r7

  • chainguard•wazuh-dashboard-plugins-fips

    < 4.14.5-r7

Showing first 50 affected entries in server-rendered view.

References (9)