CVE-2026-65912: DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR
DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADDATTR is provided as a predicate function via EXTRAELEMENTHANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe protocols like javascript: to survive sanitization and execute as DOM-based XSS when the link is activated.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65912?
The severity of CVE-2026-65912 is medium with a score of 6.1.
How do I fix CVE-2026-65912?
To fix CVE-2026-65912, upgrade DOMPurify to version 3.3.2 or later.
What type of vulnerability is CVE-2026-65912?
CVE-2026-65912 is identified as a URI validation bypass vulnerability.
What is the impact of exploiting CVE-2026-65912?
Exploiting CVE-2026-65912 can allow attackers to bypass URI-safe validation and potentially introduce unsafe content.
What component is affected by CVE-2026-65912?
CVE-2026-65912 affects the DOMPurify library specifically when using the ADD_ATTR predicate function.