CVE-2026-65902: DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags
DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULTALLOWEDTAGS and DEFAULTALLOWEDATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWEDTAGS / cfg.ALLOWEDATTR array. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitize calls inherit the widened defaults and attacker payloads using the poisoned tag/attribute name survive sanitization. removeAllHooks(), clearConfig(), and passing a fresh cfg do not recover the state; only constructing a new DOMPurify instance does.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DOMPurifyto a version that resolves this vulnerability.Fixed in 3.4.7 - Operational
If you have already created a DOMPurify instance before upgrading (v<=3.4.5), construct a new DOMPurify instance after upgrading to 3.4.7 because removeAllHooks(), clearConfig(), and passing a fresh cfg do not recover the polluted allowedTags/allowedAttributes state.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65902?
The severity of CVE-2026-65902 is rated as medium with a score of 6.1.
How do I fix CVE-2026-65902?
To fix CVE-2026-65902, upgrade DOMPurify to version 3.4.7 or later.
What products are affected by CVE-2026-65902?
CVE-2026-65902 affects versions of DOMPurify up to and including 3.4.5.
What kind of vulnerability is CVE-2026-65902?
CVE-2026-65902 is a Hook Mutation Pollution vulnerability affecting DOMPurify's sanitization process.
What should I do if I cannot upgrade to fix CVE-2026-65902?
If you cannot upgrade, consider implementing additional input validation or sanitization measures to mitigate the risk associated with CVE-2026-65902.