CVE-2026-65913
DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES
- State
- Published
- Severity
- 5.1 Medium
- Published
- Jul 23, 2026
- Updated
- Oct 8, 2026
- Reserved
- Jul 23, 2026
Description
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Affected Products
| Product | Versions |
|---|---|
DOMPurifycure53 |
|
References
- GitHub Security Advisory (GHSA-cj63-jhhr-wcxv)vendor-advisory
- VulnCheck Advisory: DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILESthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.