---
id: CVE-2026-66010
title: >-
  dompurify: DOMPurify: Cross-Site Scripting (XSS) via custom element attribute
  bypass (CVE-2026-66010)
summary: >-
  A flaw was found in DOMPurify. This vulnerability allows attackers to bypass
  application security policies by preserving sensitive attributes on custom
  elements. These attributes can then be re-injected into web page content,
  leading to Cr…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: vendor
cwe:
  - CWE-79
  - CWE-184
  - CWE-693
vendor: Red Hat
product: Red Hat Enterprise Linux 8
affected:
  - cryostat 4
  - migration_toolkit_for_virtualization
  - multicluster_engine_for_kubernetes
  - node_healthcheck_operator
  - openshift_lightspeed
  - openshift_service_mesh 3
  - 3scale_api_management_platform 2
  - advanced_cluster_management_for_kubernetes 2
  - advanced_cluster_security 4
  - amq_broker 7
  - ansible_automation_platform 2
  - build_of_apache_camel_hawtio 4
  - build_of_apache_camel_for_spring_boot 4
  - build_of_apicurio_registry 3
  - build_of_podman_desktop
  - ceph_storage 9
  - data_grid 8
  - developer_hub
  - enterprise_linux 10
  - enterprise_linux 8
  - enterprise_linux 9
  - openshift_ai_rhoai
  - openshift_container_platform 4
  - openshift_data_foundation 4
  - openshift_dev_spaces
  - openshift_gitops
  - openshift_virtualization 4
  - self_service_automation_portal 2
  - streams_for_apache_kafka 2
  - streams_for_apache_kafka 3
patched:
  - dompurify 3.4.12
published: '2026-07-24'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:22:09+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-66010.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-66010.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-66010'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2506731'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-66010'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-66010'
  - url: >-
      https://github.com/cure53/DOMPurify/security/advisories/GHSA-c2j3-45gr-mqc4
  - url: >-
      https://www.vulncheck.com/advisories/dompurify-before-hook-bypass-via-custom-element-handling
  - url: 'https://github.com/cure53/DOMPurify/pull/1537'
  - url: >-
      https://github.com/cure53/DOMPurify/commit/a9ca1e537422319a557a9a2aa61f003b23b4a197
  - url: 'https://github.com/cure53/DOMPurify/releases/tag/3.4.12'
  - url: 'https://github.com/advisories/GHSA-c2j3-45gr-mqc4'
tags:
  - csaf
  - vex
  - red-hat
  - ghsa
  - npm
  - cve.org
  - exploit-available
epss: 0.00215
epssPercentile: 0.12044
aliases:
  - GHSA-c2j3-45gr-mqc4
ecosystem: npm
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-24T14:13:53.590696Z'
ingestedAt: '2026-09-17T18:25:16.054Z'
---

## Overview

A flaw was found in DOMPurify. This vulnerability allows attackers to bypass application security policies by preserving sensitive attributes on custom elements. These attributes can then be re-injected into web page content, leading to Cross-Site Scripting (XSS) attacks. An attacker could exploit this to execute malicious scripts in a user's browser, potentially leading to information disclosure or unauthorized actions.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Cryostat 4, Migration Toolkit for Virtualization, Multicluster Engine for Kubernetes, Node HealthCheck Operator, OpenShift Lightspeed, OpenShift Service Mesh 3, … · no fix planned: Cryostat 4, Migration Toolkit for Virtualization, Multicluster Engine for Kubernetes, Node HealthCheck Operator, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-66010.json)

**dompurify: DOMPurify: Cross-Site Scripting (XSS) via custom element attribute bypass** — rated Moderate by Red Hat. Released 2026-07-24, updated 2026-10-15.

Affected:

- Cryostat 4
- Migration Toolkit for Virtualization
- Multicluster Engine for Kubernetes
- Node HealthCheck Operator
- OpenShift Lightspeed
- OpenShift Service Mesh 3
- Red Hat 3scale API Management Platform 2
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4
- Red Hat AMQ Broker 7
- Red Hat Ansible Automation Platform 2
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat build of Apicurio Registry 3
- Red Hat Build of Podman Desktop
- Red Hat Ceph Storage 9
- Red Hat Data Grid 8
- Red Hat Developer Hub
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat Openshift Data Foundation 4
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift GitOps
- Red Hat OpenShift Virtualization 4
- Self-service automation portal 2
- streams for Apache Kafka 2
- streams for Apache Kafka 3

No fix planned:

- Cryostat 4
- Migration Toolkit for Virtualization
- Multicluster Engine for Kubernetes
- Node HealthCheck Operator
- OpenShift Lightspeed
- OpenShift Service Mesh 3
- Red Hat 3scale API Management Platform 2
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4
- Red Hat AMQ Broker 7
- Red Hat Ansible Automation Platform 2
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat build of Apicurio Registry 3
- Red Hat Build of Podman Desktop
- Red Hat Ceph Storage 9
- Red Hat Data Grid 8
- Red Hat Developer Hub
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat Openshift Data Foundation 4
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift GitOps
- Red Hat OpenShift Virtualization 4
- Self-service automation portal 2
- streams for Apache Kafka 2
- streams for Apache Kafka 3

Not affected:

- Red Hat Hardened Images

## Remediation

Fix deferred

Workarounds / mitigations:

- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

## Package advisory (CVE-2026-66010)

Affected packages:

- `dompurify <= 3.4.11`

Patched in:

- `dompurify 3.4.12`

Source: https://github.com/advisories/GHSA-c2j3-45gr-mqc4