Product

DOMPurify

1 brief RSS

CVE-2026-65898: DOMPurify Vulnerability Leads to Stored Cross-Site Scripting

A vulnerability in DOMPurify before version 3.4.11 allows attackers to achieve stored Cross-Site Scripting (XSS) by manipulating the `ALLOWED_ATTR` allowlist through an `uponSanitizeAttribute` hook, leading to client-side code execution.

DOMPurify xss javascript web-vulnerability client-side

2t 1c 2i 1h ago