CVE-2026-65913: DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USEPROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65913?
The severity of CVE-2026-65913 is classified as medium with a CVSS score of 6.1.
How do I fix CVE-2026-65913?
To fix CVE-2026-65913, upgrade DOMPurify to version 3.3.2 or later.
What vulnerability type is CVE-2026-65913 associated with?
CVE-2026-65913 is associated with a prototype pollution vulnerability.
What impact does CVE-2026-65913 have on my application?
CVE-2026-65913 allows attackers to bypass attribute filtering, potentially leading to arbitrary code execution.
What versions of DOMPurify are affected by CVE-2026-65913?
DOMPurify versions prior to 3.3.2 are affected by CVE-2026-65913.