Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2026-65912

DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe protocols like javascript: to survive sanitization and execute as DOM-based XSS when the link is activated.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

cure53 DOMPurify

Default version status: unaffected

  • 0 to < 3.3.2affected
  • 3.3.2unaffected
pkg:npm/dompurify

References