Executive brief
DOMPurify, a widely used library for cleaning HTML to prevent security attacks, contains a flaw in how it validates web links. If a developer configures the library with specific custom rules, an attacker can bypass security filters to include malicious 'javascript:' links. If a user clicks one of these links, it could allow the attacker to steal data or perform unauthorized actions in the user's browser session.
Technical details
A vulnerability exists in DOMPurify's _isValidAttribute function when using the EXTRA_ELEMENT_HANDLING.attributeCheck configuration. When a predicate function is provided via ADD_ATTR and returns true, the library short-circuits the attribute validation process, skipping subsequent URI-safe protocol checks. This allows malicious protocols such as 'javascript:' to bypass the sanitizer. An attacker can exploit this to execute DOM-based Cross-Site Scripting (XSS) if they can influence the input being sanitized and the victim interacts with the resulting malicious element (e.g., clicking a link). The issue is resolved in version 3.3.2.
Affected products
- cure53 DOMPurify < 3.3.2
Timeline
- 2026-04-01: advisory: GHSA-cjmm-f4jc-qw8r published by cure53
- 2026-07-23: disclosed: CVE-2026-65912 published to NVD
- 2026-07-23: patched: Fix confirmed in version 3.3.2