What is CVE-2026-65898?
In DOMPurify versions before 3.4.11, the setConfig() method fails to clone the ALLOWED_ATTR allowlist when used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. This enables attackers to register a hook that conditionally allows dangerous attributes like onerror for trusted elements, potentially leading to XSS. Users should update DOMPurify to version 3.4.11 or later.
Azərbaycanca: DOMPurify 3.4.11-dən əvvəlki versiyalarda setConfig() metodu ilə uponSanitizeAttribute hook istifadə edildikdə ALLOWED_ATTR siyahısını klonlamadığı üçün zəiflik yaranır. Bu, təcavüzkara etibarlı elementlər üçün onerror kimi təhlükəli atributları icazə siyahısına daimi əlavə etməyə imkan verir. Təhlükəsizlik üçün kitabxananı ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-79
FAQ2
What is the main flaw in DOMPurify that causes the CVE-2026-65898 vulnerability when using setConfig() with an uponSanitizeAttribute hook?
In DOMPurify versions before 3.4.11, the setConfig() method fails to clone the ALLOWED_ATTR allowlist when used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist.
Which version of DOMPurify is recommended to update to in order to mitigate CVE-2026-65898?
Users should update DOMPurify to version 3.4.11 or later.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.