{"id":"CVE-2026-65902","title":"DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags","summary":"DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-501"],"vendor":"cure53","product":"DOMPurify","affected":["DOMPurify < 3.4.7"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-23T13:58:18.807154Z"},"exploitAvailable":true,"published":"2026-07-23","updated":"2026-10-29","sourceUpdated":"2026-10-29T21:16:29.413Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-65902","references":[{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-76mc-f452-cxcm","label":"GitHub Security Advisory (GHSA-76mc-f452-cxcm)"},{"url":"https://github.com/cure53/DOMPurify/commit/7996f1dc78eb8b7922388aed75d94a9f8fad9a36","label":"Patch Commit"},{"url":"https://www.vulncheck.com/advisories/dompurify-before-hook-mutation-pollution-via-allowedtags","label":"VulnCheck Advisory: DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags"}],"tags":["cve.org","exploit-available"],"epss":0.00355,"epssPercentile":0.2946,"ingestedAt":"2026-11-03T08:39:35.583Z","slug":"CVE-2026-65902","body":"## Overview\n\nDOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitize calls inherit the widened defaults and attacker payloads using the poisoned tag/attribute name survive sanitization. removeAllHooks(), clearConfig(), and passing a fresh cfg do not recover the state; only constructing a new DOMPurify instance does.\n\n## Affected\n\n- `DOMPurify < 3.4.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}