CVE-2026-65911: DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage
In DOMPurify through 3.3.3, function predicates supplied via ADDATTR or ADDTAGS to DOMPurify.sanitize() persist in internal state (EXTRAELEMENTHANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADDATTR or ADDTAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can allow dangerous event-handler attributes or forbidden tags (bypassing FORBIDTAGS) to survive sanitization, resulting in cross-site scripting. The vendor (Cure53) considers this an edge case outside DOMPurify's threat model; the referenced advisory lists 3.4.0 as the patched version.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DOMPurifyto a version that resolves this vulnerability.Fixed in 3.4.0 - Configuration
Ensure that for a given DOMPurify instance, ADD_ATTR and ADD_TAGS are provided consistently (as function predicates) on each sanitize() call. Do not pass ADD_ATTR/ADD_TAGS as an array on later calls after providing function handlers, to avoid function predicate state (EXTRA_ELEMENT_HANDLING) persisting across calls in versions through 3.3.3.
DOMPurify.sanitize() (ADD_ATTR/ADD_TAGS usage) ADD_ATTR/ADD_TAGS handling across calls = Use function predicates consistently; do not switch to array form on the same DOMPurify instance
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65911?
The severity of CVE-2026-65911 is rated as medium with a score of 6.1.
How do I fix CVE-2026-65911?
To mitigate CVE-2026-65911, update DOMPurify to version 3.4.0 or later.
What type of vulnerability is CVE-2026-65911?
CVE-2026-65911 is an XSS (Cross-Site Scripting) vulnerability.
What software is affected by CVE-2026-65911?
CVE-2026-65911 affects versions of DOMPurify prior to 3.4.0.
How does CVE-2026-65911 occur?
CVE-2026-65911 occurs due to state leakage from function predicates supplied via ADD_ATTR or ADD_TAGS in DOMPurify.