{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/dompurify/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-65898"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["DOMPurify"],"_cs_severities":["high"],"_cs_tags":["xss","javascript","web-vulnerability","client-side"],"_cs_type":"advisory","_cs_vendors":["cure53"],"content_html":"\u003cp\u003eCVE-2026-65898 describes a significant security flaw in the DOMPurify JavaScript library, affecting versions prior to 3.4.11. This vulnerability arises because \u003ccode\u003eDOMPurify\u003c/code\u003e fails to properly clone the \u003ccode\u003eALLOWED_ATTR\u003c/code\u003e allowlist when the \u003ccode\u003esetConfig()\u003c/code\u003e method is used in conjunction with an \u003ccode\u003euponSanitizeAttribute\u003c/code\u003e hook. This oversight permits an attacker to register a malicious hook that can permanently mutate the global \u003ccode\u003eALLOWED_ATTR\u003c/code\u003e allowlist. Consequently, dangerous attributes, such as \u003ccode\u003eonerror\u003c/code\u003e, can be conditionally allowed for otherwise trusted HTML elements. This paves the way for attackers to submit untrusted content that leverages the polluted allowlist, enabling the execution of event handlers and ultimately leading to stored Cross-Site Scripting (XSS) attacks in affected web applications. This vulnerability poses a risk to web applications that rely on \u003ccode\u003eDOMPurify\u003c/code\u003e for sanitization, potentially compromising user data and application integrity.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a web application utilizing DOMPurify versions prior to 3.4.11 and the \u003ccode\u003esetConfig()\u003c/code\u003e method with an \u003ccode\u003euponSanitizeAttribute\u003c/code\u003e hook.\u003c/li\u003e\n\u003cli\u003eThe attacker injects malicious client-side script into the application, which registers a crafted \u003ccode\u003euponSanitizeAttribute\u003c/code\u003e hook with the DOMPurify instance.\u003c/li\u003e\n\u003cli\u003eThis malicious hook exploits the cloning failure to permanently modify the shared \u003ccode\u003eALLOWED_ATTR\u003c/code\u003e allowlist, adding dangerous attributes like \u003ccode\u003eonerror\u003c/code\u003e to the list for specific trusted HTML elements under certain conditions.\u003c/li\u003e\n\u003cli\u003eThe attacker then submits a second payload of untrusted content (e.g., an HTML snippet in a comment or post). This content includes a seemingly trusted HTML element containing one of the newly allowed dangerous attributes (e.g., \u003ccode\u003e\u0026lt;img src=\u0026quot;x\u0026quot; onerror=\u0026quot;alert(document.cookie)\u0026quot;\u0026gt;\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eWhen a victim's browser attempts to render this content, DOMPurify sanitizes it using the now-polluted \u003ccode\u003eALLOWED_ATTR\u003c/code\u003e allowlist, which permits the dangerous attribute to remain.\u003c/li\u003e\n\u003cli\u003eThe dangerous attribute's event handler (e.g., \u003ccode\u003eonerror\u003c/code\u003e) then executes in the victim's browser, leading to client-side code execution, typically as stored Cross-Site Scripting (XSS).\u003c/li\u003e\n\u003cli\u003eThe XSS payload can then perform actions such as session hijacking, data exfiltration, defacement, or redirection, impacting the integrity and confidentiality of the web application and its users.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2026-65898 can lead to severe consequences for web applications and their users, rated with a CVSS v3.1 Base Score of 7.2 (High). Stored Cross-Site Scripting (XSS) allows attackers to inject malicious scripts into a web application, which are then executed in the browsers of other users who view the compromised content. This can result in session hijacking, enabling attackers to impersonate legitimate users and access sensitive information. It can also lead to data theft, website defacement, redirection to malicious sites, or the delivery of drive-by downloads. The integrity and confidentiality of user data, including credentials and personal information, are at high risk. Any web application that relies on DOMPurify for content sanitization and uses the affected configuration is vulnerable, potentially exposing a broad user base to these client-side attacks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate DOMPurify to version 3.4.11 or later immediately to address CVE-2026-65898.\u003c/li\u003e\n\u003cli\u003eReview all instances where \u003ccode\u003eDOMPurify.setConfig()\u003c/code\u003e is used with an \u003ccode\u003euponSanitizeAttribute\u003c/code\u003e hook to ensure that any custom logic does not inadvertently introduce similar attribute allowlist pollution even after updating the library.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T14:23:17Z","date_published":"2026-07-23T14:23:17Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-65898-dompurify-xss/","summary":"A vulnerability in DOMPurify before version 3.4.11 allows attackers to achieve stored Cross-Site Scripting (XSS) by manipulating the `ALLOWED_ATTR` allowlist through an `uponSanitizeAttribute` hook, leading to client-side code execution.","title":"CVE-2026-65898: DOMPurify Vulnerability Leads to Stored Cross-Site Scripting","url":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-65898-dompurify-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - DOMPurify","version":"https://jsonfeed.org/version/1.1"}