{"id":"CVE-2026-66010","title":"dompurify: DOMPurify: Cross-Site Scripting (XSS) via custom element attribute bypass (CVE-2026-66010)","summary":"A flaw was found in DOMPurify. This vulnerability allows attackers to bypass application security policies by preserving sensitive attributes on custom elements. These attributes can then be re-injected into web page content, leading to Cr…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"vendor","cwe":["CWE-79","CWE-184","CWE-693"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","affected":["cryostat 4","migration_toolkit_for_virtualization","multicluster_engine_for_kubernetes","node_healthcheck_operator","openshift_lightspeed","openshift_service_mesh 3","3scale_api_management_platform 2","advanced_cluster_management_for_kubernetes 2","advanced_cluster_security 4","amq_broker 7","ansible_automation_platform 2","build_of_apache_camel_hawtio 4","build_of_apache_camel_for_spring_boot 4","build_of_apicurio_registry 3","build_of_podman_desktop","ceph_storage 9","data_grid 8","developer_hub","enterprise_linux 10","enterprise_linux 8","enterprise_linux 9","openshift_ai_rhoai","openshift_container_platform 4","openshift_data_foundation 4","openshift_dev_spaces","openshift_gitops","openshift_virtualization 4","self_service_automation_portal 2","streams_for_apache_kafka 2","streams_for_apache_kafka 3"],"patched":["dompurify 3.4.12"],"published":"2026-07-24","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:22:09+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-66010.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-66010.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-66010"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506731"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-66010"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66010"},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-c2j3-45gr-mqc4"},{"url":"https://www.vulncheck.com/advisories/dompurify-before-hook-bypass-via-custom-element-handling"},{"url":"https://github.com/cure53/DOMPurify/pull/1537"},{"url":"https://github.com/cure53/DOMPurify/commit/a9ca1e537422319a557a9a2aa61f003b23b4a197"},{"url":"https://github.com/cure53/DOMPurify/releases/tag/3.4.12"},{"url":"https://github.com/advisories/GHSA-c2j3-45gr-mqc4"}],"tags":["csaf","vex","red-hat","ghsa","npm","cve.org","exploit-available"],"epss":0.00215,"epssPercentile":0.1185,"aliases":["GHSA-c2j3-45gr-mqc4"],"ecosystem":"npm","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-24T14:13:53.590696Z"},"ingestedAt":"2026-09-17T18:25:16.054Z","slug":"CVE-2026-66010","body":"## Overview\n\nA flaw was found in DOMPurify. This vulnerability allows attackers to bypass application security policies by preserving sensitive attributes on custom elements. These attributes can then be re-injected into web page content, leading to Cross-Site Scripting (XSS) attacks. An attacker could exploit this to execute malicious scripts in a user's browser, potentially leading to information disclosure or unauthorized actions.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Cryostat 4, Migration Toolkit for Virtualization, Multicluster Engine for Kubernetes, Node HealthCheck Operator, OpenShift Lightspeed, OpenShift Service Mesh 3, … · no fix planned: Cryostat 4, Migration Toolkit for Virtualization, Multicluster Engine for Kubernetes, Node HealthCheck Operator, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-66010.json)\n\n**dompurify: DOMPurify: Cross-Site Scripting (XSS) via custom element attribute bypass** — rated Moderate by Red Hat. Released 2026-07-24, updated 2026-10-15.\n\nAffected:\n\n- Cryostat 4\n- Migration Toolkit for Virtualization\n- Multicluster Engine for Kubernetes\n- Node HealthCheck Operator\n- OpenShift Lightspeed\n- OpenShift Service Mesh 3\n- Red Hat 3scale API Management Platform 2\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 4\n- Red Hat AMQ Broker 7\n- Red Hat Ansible Automation Platform 2\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel for Spring Boot 4\n- Red Hat build of Apicurio Registry 3\n- Red Hat Build of Podman Desktop\n- Red Hat Ceph Storage 9\n- Red Hat Data Grid 8\n- Red Hat Developer Hub\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat OpenShift GitOps\n- Red Hat OpenShift Virtualization 4\n- Self-service automation portal 2\n- streams for Apache Kafka 2\n- streams for Apache Kafka 3\n\nNo fix planned:\n\n- Cryostat 4\n- Migration Toolkit for Virtualization\n- Multicluster Engine for Kubernetes\n- Node HealthCheck Operator\n- OpenShift Lightspeed\n- OpenShift Service Mesh 3\n- Red Hat 3scale API Management Platform 2\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 4\n- Red Hat AMQ Broker 7\n- Red Hat Ansible Automation Platform 2\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel for Spring Boot 4\n- Red Hat build of Apicurio Registry 3\n- Red Hat Build of Podman Desktop\n- Red Hat Ceph Storage 9\n- Red Hat Data Grid 8\n- Red Hat Developer Hub\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat OpenShift GitOps\n- Red Hat OpenShift Virtualization 4\n- Self-service automation portal 2\n- streams for Apache Kafka 2\n- streams for Apache Kafka 3\n\nNot affected:\n\n- Red Hat Hardened Images\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n## Package advisory (CVE-2026-66010)\n\nAffected packages:\n\n- `dompurify <= 3.4.11`\n\nPatched in:\n\n- `dompurify 3.4.12`\n\nSource: https://github.com/advisories/GHSA-c2j3-45gr-mqc4","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":222210,"id":"CVE-2026-66010","ts":1792065080460,"field":"severity","old":"low","new":"medium"},{"seq":215151,"id":"CVE-2026-66010","ts":1790984145616,"field":"severity","old":"medium","new":"low"}]}