Attack Chain

1. An attacker identifies a web application utilizing DOMPurify versions prior to 3.4.11 and the setConfig() method with an uponSanitizeAttribute hook.
2. The attacker injects malicious client-side script into the application, which registers a crafted uponSanitizeAttribute hook with the DOMPurify instance.
3. This malicious hook exploits the cloning failure to permanently modify the shared ALLOWED_ATTR allowlist, adding dangerous attributes like onerror to the list for specific trusted HTML elements under certain conditions.
4. The attacker then submits a second payload of untrusted content (e.g., an HTML snippet in a comment or post). This content includes a seemingly trusted HTML element containing one of the newly allowed dangerous attributes (e.g., <img src="x" onerror="alert(document.cookie)">).
5. When a victim's browser attempts to render this content, DOMPurify sanitizes it using the now-polluted ALLOWED_ATTR allowlist, which permits the dangerous attribute to remain.
6. The dangerous attribute's event handler (e.g., onerror) then executes in the victim's browser, leading to client-side code execution, typically as stored Cross-Site Scripting (XSS).
7. The XSS payload can then perform actions such as session hijacking, data exfiltration, defacement, or redirection, impacting the integrity and confidentiality of the web application and its users.

Impact

The successful exploitation of CVE-2026-65898 can lead to severe consequences for web applications and their users, rated with a CVSS v3.1 Base Score of 7.2 (High). Stored Cross-Site Scripting (XSS) allows attackers to inject malicious scripts into a web application, which are then executed in the browsers of other users who view the compromised content. This can result in session hijacking, enabling attackers to impersonate legitimate users and access sensitive information. It can also lead to data theft, website defacement, redirection to malicious sites, or the delivery of drive-by downloads. The integrity and confidentiality of user data, including credentials and personal information, are at high risk. Any web application that relies on DOMPurify for content sanitization and uses the affected configuration is vulnerable, potentially exposing a broad user base to these client-side attacks.

Recommendation

• Update DOMPurify to version 3.4.11 or later immediately to address CVE-2026-65898.
• Review all instances where DOMPurify.setConfig() is used with an uponSanitizeAttribute hook to ensure that any custom logic does not inadvertently introduce similar attribute allowlist pollution even after updating the library.