CVE-2026-65898
HIGH
NVD
CVSS Score
7.2
Severity
HIGH
Published
Jul 23, 2026
Vendor
unknown
Description
DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.