Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2026-66010

DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into innerHTML sinks, creating second-order XSS gadgets.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

cure53 DOMPurify

Default version status: unaffected

  • 0 to < 3.4.12affected
  • 3.4.12unaffected
pkg:npm/dompurify

References