Executive brief
DOMPurify is a popular library used to clean HTML and prevent malicious code from running in web browsers. A flaw in how it handles internal settings allows security rules from one cleaning session to "leak" into the next one if the same library instance is reused. This could allow an attacker to bypass security filters and execute malicious scripts (Cross-Site Scripting) in a user's browser, potentially leading to account takeover or data theft.
Technical details
In DOMPurify through 3.3.3, function predicates provided via ADD_ATTR or ADD_TAGS to the sanitize() method persist in the internal EXTRA_ELEMENT_HANDLING state across subsequent calls on the same instance. If a subsequent call provides these configuration options as an array instead of a function, the internal state is neither cleared nor overwritten. This allows a 'stale' function handler from a previous privileged call to approve dangerous attributes (like event handlers) or forbidden tags (bypassing FORBID_TAGS) in a later, less-privileged call. This vulnerability is particularly relevant in server-side environments (Node.js) where a single DOMPurify instance is often shared across multiple requests. The issue is addressed in version 3.4.0.
Affected products
- Cure53 DOMPurify <= 3.3.3
Timeline
- 2026-04-01: advisory: Initial GHSA advisory published by Cure53
- 2026-07-23: disclosed: CVE-2026-65911 published and added to NVD