CVE-2026-65898: DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig
DOMPurify before 3.4.11 fails to clone the ALLOWEDATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DOMPurifyto a version that resolves this vulnerability.Fixed in 3.4.11 - Configuration
Upgrade DOMPurify to 3.4.11 or later to prevent permanent attribute allowlist pollution; if you cannot upgrade immediately, do not use setConfig() with an uponSanitizeAttribute hook until the upgrade is applied.
DOMPurify setConfig() with uponSanitizeAttribute hook = Avoid using setConfig() with an uponSanitizeAttribute hook (or remove the hook) prior to upgrading
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65898?
The severity of CVE-2026-65898 is classified as high with a score of 7.2.
How do I fix CVE-2026-65898?
To fix CVE-2026-65898, update DOMPurify to version 3.4.11 or later.
What is the risk associated with CVE-2026-65898?
CVE-2026-65898 poses a risk level of 44, indicating a significant potential for exploitation.
What impact can CVE-2026-65898 have on my application?
CVE-2026-65898 can lead to permanent attribute allowlist pollution, allowing attackers to inject harmful attributes.
What is the affected software for CVE-2026-65898?
The affected software for CVE-2026-65898 is DOMPurify versions prior to 3.4.11.