# CVE-2026-65911: Cure53 DOMPurify XSS via state leakage in ADD_ATTR and ADD_TAGS

Source: https://junglewise.ai/threats/cve-2026-65911-cure53-dompurify-xss-via-state-leakage-in-add-attr-and-add-tags  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-65911 · Severity: medium · CVSS 6.1 · Published 2026-07-23

DOMPurify is a popular library used to clean HTML and prevent malicious code from running in web browsers. A flaw in how it handles internal settings allows security rules from one cleaning session to "leak" into the next one if the same library instance is reused. This could allow an attacker to bypass security filters and execute malicious scripts (Cross-Site Scripting) in a user's browser, potentially leading to account takeover or data theft.

## Quick answers

**Is CVE-2026-65911 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65911 being exploited in the wild.

**How severe is CVE-2026-65911?** Medium severity, with a CVSS score of 6.1, published 23 July 2026.

**Which products and versions are affected?** Cure53 DOMPurify <= 3.3.3.

**Is there a fix for CVE-2026-65911?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-65911 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-65911?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

In DOMPurify through 3.3.3, function predicates provided via ADD_ATTR or ADD_TAGS to the sanitize() method persist in the internal EXTRA_ELEMENT_HANDLING state across subsequent calls on the same instance. If a subsequent call provides these configuration options as an array instead of a function, the internal state is neither cleared nor overwritten. This allows a 'stale' function handler from a previous privileged call to approve dangerous attributes (like event handlers) or forbidden tags (bypassing FORBID_TAGS) in a later, less-privileged call. This vulnerability is particularly relevant in server-side environments (Node.js) where a single DOMPurify instance is often shared across multiple requests. The issue is addressed in version 3.4.0.

## Affected products

- Cure53 DOMPurify <= 3.3.3

## Timeline

- 2026-04-01: advisory: Initial GHSA advisory published by Cure53
- 2026-07-23: disclosed: CVE-2026-65911 published and added to NVD

## References

- [https://github.com/cure53/DOMPurify/security/advisories/GHSA-9p3w-6h5p-cv75](https://github.com/cure53/DOMPurify/security/advisories/GHSA-9p3w-6h5p-cv75)
- [https://www.vulncheck.com/advisories/dompurify-before-xss-via-add-attr-add-tags-state-leakage](https://www.vulncheck.com/advisories/dompurify-before-xss-via-add-attr-add-tags-state-leakage)