[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-65911":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":44,"aliases":54,"duplicate_of":9,"upstream":57,"downstream":58,"duplicates":63,"related":64,"reserved_at":9,"published_at":65,"modified_at":66,"state":67,"summary":68,"references_raw":76,"kevs":105,"epss":106,"epss_history":109,"metrics":284,"affected":302},"CVE-2026-65911","In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can allow dangerous event-handler attributes or forbidden tags (bypassing FORBID_TAGS) to survive sanitization, resulting in cross-site scripting. The vendor (Cure53) considers this an edge case outside DOMPurify's threat model; the referenced advisory lists 3.4.0 as the patched version.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-79","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","weakness","Stable","Base","High",[20,24,28,32,36,40],{"id":21,"name":22,"techniques":23},"CAPEC-209","XSS Using MIME Type Mismatch",[],{"id":25,"name":26,"techniques":27},"CAPEC-588","DOM-Based XSS",[],{"id":29,"name":30,"techniques":31},"CAPEC-591","Reflected XSS",[],{"id":33,"name":34,"techniques":35},"CAPEC-592","Stored XSS",[],{"id":37,"name":38,"techniques":39},"CAPEC-63","Cross-Site Scripting (XSS)",[],{"id":41,"name":42,"techniques":43},"CAPEC-85","AJAX Footprinting",[],[45],{"_key":46,"name":47,"source":48,"url":49,"maturity":50,"reliability_score":51,"verified":52,"type":9,"platforms":53,"requires_auth":9,"exploitdb":9,"metasploit":9},"GITHUB_CURE53_DOMPURIFY","Dompurify","github","https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf","poc",0.3,false,[],[55,56],"UBUNTU-CVE-2026-65911","DEBIAN-CVE-2026-65911",[],[59,61],{"_key":60},"RHSA-2026:58500",{"_key":62},"RHSA-2026:54517",[],[],"2026-07-23T13:16:22.748Z","2026-07-27T16:20:37.732Z","Analyzed",{"cisa_kev":52,"cisa_ransomware":52,"cisa_vendor":9,"epss_severity":69,"epss_score":70,"severity":71,"severity_score":72,"severity_version":73,"severity_source":74,"severity_vector":75,"severity_status":67},"low",0.00233,"medium",6.1,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",[77,87,91,95,99],{"url":78,"sources":79,"tags":82},"https://github.com/cure53/DOMPurify/security/advisories/GHSA-9p3w-6h5p-cv75",[74,80,81],"nvd","osv_ubuntu",[83,84,85,86],"Vendor Advisory","Exploit","Third Party Advisory","REPORT",{"url":88,"sources":89,"tags":90},"https://www.vulncheck.com/advisories/dompurify-before-xss-via-add-attr-add-tags-state-leakage",[74,80],[85],{"url":92,"sources":93,"tags":94},"https://ubuntu.com/security/CVE-2026-65911",[81],[86],{"url":96,"sources":97,"tags":98},"https://www.cve.org/CVERecord?id=CVE-2026-65911",[81],[86],{"url":100,"sources":101,"tags":103},"https://security-tracker.debian.org/tracker/CVE-2026-65911",[102],"osv_debian",[104],"Advisory",[],{"date":107,"score":70,"percentile":108},"2026-09-19",0.14429,[110,114,117,120,123,126,130,133,136,139,142,145,148,151,154,157,160,163,166,169,172,175,177,180,183,186,189,192,195,198,202,205,208,211,214,217,220,223,226,229,232,235,238,241,244,247,250,253,256,259,262,265,268,271,274,277,280,283],{"date":111,"score":112,"percentile":113},"2026-07-24",0.00177,0.07503,{"date":115,"score":112,"percentile":116},"2026-07-25",0.07507,{"date":118,"score":112,"percentile":119},"2026-07-26",0.07544,{"date":121,"score":112,"percentile":122},"2026-07-27",0.07532,{"date":124,"score":112,"percentile":125},"2026-07-28",0.07578,{"date":127,"score":128,"percentile":129},"2026-07-29",0.00191,0.09021,{"date":131,"score":128,"percentile":132},"2026-07-30",0.09012,{"date":134,"score":128,"percentile":135},"2026-07-31",0.09005,{"date":137,"score":128,"percentile":138},"2026-08-01",0.0899,{"date":140,"score":128,"percentile":141},"2026-08-02",0.08976,{"date":143,"score":128,"percentile":144},"2026-08-03",0.08974,{"date":146,"score":128,"percentile":147},"2026-08-04",0.08953,{"date":149,"score":128,"percentile":150},"2026-08-05",0.08925,{"date":152,"score":128,"percentile":153},"2026-08-06",0.08906,{"date":155,"score":128,"percentile":156},"2026-08-07",0.089,{"date":158,"score":128,"percentile":159},"2026-08-08",0.08898,{"date":161,"score":128,"percentile":162},"2026-08-09",0.08891,{"date":164,"score":128,"percentile":165},"2026-08-10",0.08904,{"date":167,"score":128,"percentile":168},"2026-08-11",0.08954,{"date":170,"score":128,"percentile":171},"2026-08-12",0.0897,{"date":173,"score":128,"percentile":174},"2026-08-13",0.08962,{"date":176,"score":128,"percentile":141},"2026-08-14",{"date":178,"score":128,"percentile":179},"2026-08-15",0.09003,{"date":181,"score":128,"percentile":182},"2026-08-16",0.09046,{"date":184,"score":128,"percentile":185},"2026-08-17",0.09045,{"date":187,"score":128,"percentile":188},"2026-08-18",0.0904,{"date":190,"score":128,"percentile":191},"2026-08-19",0.09076,{"date":193,"score":128,"percentile":194},"2026-08-20",0.09069,{"date":196,"score":128,"percentile":197},"2026-08-21",0.09048,{"date":199,"score":200,"percentile":201},"2026-08-22",0.00205,0.10835,{"date":203,"score":200,"percentile":204},"2026-08-23",0.10795,{"date":206,"score":70,"percentile":207},"2026-08-24",0.13905,{"date":209,"score":70,"percentile":210},"2026-08-25",0.13904,{"date":212,"score":70,"percentile":213},"2026-08-26",0.13951,{"date":215,"score":70,"percentile":216},"2026-08-27",0.13936,{"date":218,"score":70,"percentile":219},"2026-08-28",0.1396,{"date":221,"score":70,"percentile":222},"2026-08-29",0.13962,{"date":224,"score":70,"percentile":225},"2026-08-30",0.13973,{"date":227,"score":70,"percentile":228},"2026-08-31",0.13968,{"date":230,"score":70,"percentile":231},"2026-09-01",0.13982,{"date":233,"score":70,"percentile":234},"2026-09-02",0.13986,{"date":236,"score":70,"percentile":237},"2026-09-03",0.13987,{"date":239,"score":70,"percentile":240},"2026-09-04",0.14005,{"date":242,"score":70,"percentile":243},"2026-09-05",0.14035,{"date":245,"score":70,"percentile":246},"2026-09-06",0.14051,{"date":248,"score":70,"percentile":249},"2026-09-07",0.14045,{"date":251,"score":70,"percentile":252},"2026-09-08",0.14048,{"date":254,"score":70,"percentile":255},"2026-09-09",0.14106,{"date":257,"score":70,"percentile":258},"2026-09-10",0.14094,{"date":260,"score":70,"percentile":261},"2026-09-11",0.14102,{"date":263,"score":70,"percentile":264},"2026-09-12",0.14214,{"date":266,"score":70,"percentile":267},"2026-09-13",0.14168,{"date":269,"score":70,"percentile":270},"2026-09-14",0.14184,{"date":272,"score":70,"percentile":273},"2026-09-15",0.1424,{"date":275,"score":70,"percentile":276},"2026-09-16",0.14288,{"date":278,"score":70,"percentile":279},"2026-09-17",0.14328,{"date":281,"score":70,"percentile":282},"2026-09-18",0.14461,{"date":107,"score":70,"percentile":108},[285,293,297,300],{"source":74,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":286,"cvss_v4_0":290},{"baseScore":72,"baseSeverity":287,"vectorString":75,"impactScore":288,"exploitabilityScore":289},"MEDIUM",4.5,7.2,{"baseScore":291,"baseSeverity":287,"vectorString":292,"impactScore":9,"exploitabilityScore":9},5.1,"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",{"source":80,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":294,"cvss_v4_0":295},{"baseScore":72,"baseSeverity":287,"vectorString":75,"impactScore":288,"exploitabilityScore":289},{"baseScore":291,"baseSeverity":287,"vectorString":296,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",{"source":81,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":298,"cvss_v4_0":299},{"baseScore":72,"baseSeverity":9,"vectorString":75,"impactScore":288,"exploitabilityScore":289},{"baseScore":291,"baseSeverity":9,"vectorString":292,"impactScore":9,"exploitabilityScore":9},{"source":102,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":301},{"baseScore":291,"baseSeverity":9,"vectorString":296,"impactScore":9,"exploitabilityScore":9},[303,315,328],{"ecosystem":9,"name":304,"vendor":305,"product":306,"cpe_part":307,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":308},"DOMPurify","cure53","dompurify","a",[309],{"version":310,"is_range":311,"range_type":312,"version_start":9,"version_start_type":9,"version_end":313,"version_end_type":314,"fixed_in":9},"lt3.4.0",true,"cpe","3.4.0","excluding",{"ecosystem":316,"name":317,"vendor":318,"product":317,"cpe_part":9,"purl_type":319,"purl_namespace":318,"purl_name":317,"source":9,"versions":320},"Debian","node-dompurify","debian","deb",[321,324,325],{"version":322,"is_range":311,"range_type":323,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all","ecosystem",{"version":322,"is_range":311,"range_type":323,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":326,"is_range":311,"range_type":323,"version_start":9,"version_start_type":9,"version_end":327,"version_end_type":314,"fixed_in":9},"lt3_4_1+dfsg_1","3.4.1+dfsg-1",{"ecosystem":329,"name":317,"vendor":330,"product":317,"cpe_part":9,"purl_type":319,"purl_namespace":330,"purl_name":317,"source":9,"versions":331},"Ubuntu","ubuntu",[332,333,334],{"version":322,"is_range":311,"range_type":323,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":322,"is_range":311,"range_type":323,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":322,"is_range":311,"range_type":323,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9}]