CVE-2026-65898: CURE53 Dompurify

High severity, CVSS 7.2. EPSS: 0.3% chance of exploitation in the next 30 days.

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.

Affected products

• CURE53 Dompurify: before 3.4.11 (fixed in 3.4.11)

Published 2026-07-23. Last modified 2026-07-28.