CVE-2026-65899
published 2026-07-23CVE-2026-65899: DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust…
PriorityP428medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.41%
34.4th percentile
DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Passing TRUSTED_TYPES_POLICY: null on the later call also does not clear the retained policy.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cure53 | dompurify | < 3.4.9 | 3.4.9 |
| cure53 | dompurify | >= 3.0.0 < 3.4.9 | 3.4.9 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv4.05.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset
vendor_redhat·2026-07-23·CVSS 6.1
CVE-2026-65899 [MEDIUM] CWE-79 dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset
dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset
DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Passing TRUSTED_TYPES_POLICY: null on the later call also does not clear the retained policy.
A flaw was found in DOMPurify where the clearConfig() function does not properly reset the retained Trusted Types policy. This can lead to a DOMPurify instanc
VulDB
cure53 DOMPurify up to 3.4.8 clearConfig cross site scripting (EUVD-2026-48268)
vuldb·2026-07-25·CVSS 6.1
CVE-2026-65899 [MEDIUM] cure53 DOMPurify up to 3.4.8 clearConfig cross site scripting (EUVD-2026-48268)
A vulnerability marked as problematic has been reported in cure53 DOMPurify up to 3.4.8. This impacts the function clearConfig. The manipulation leads to cross site scripting.
This vulnerability is traded as CVE-2026-65899. It is possible to initiate the attack remotely. There is no exploit available.
It is suggested to upgrade the affected component.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-65899 fbthrift: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65899 [MEDIUM] CVE-2026-65899 fbthrift: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [fedora-all]
CVE-2026-65899 fbthrift: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. P
Bugzilla
CVE-2026-65899 cachelib: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65899 [MEDIUM] CVE-2026-65899 cachelib: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [fedora-all]
CVE-2026-65899 cachelib: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. P
Bugzilla
CVE-2026-65899 forgejo: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65899 [MEDIUM] CVE-2026-65899 forgejo: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [fedora-all]
CVE-2026-65899 forgejo: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Pa
Bugzilla
CVE-2026-65899 nextcloud: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65899 [MEDIUM] CVE-2026-65899 nextcloud: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [epel-all]
CVE-2026-65899 nextcloud: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Pa
Bugzilla
CVE-2026-65899 cachelib: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65899 [MEDIUM] CVE-2026-65899 cachelib: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [epel-all]
CVE-2026-65899 cachelib: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Pas
Bugzilla
CVE-2026-65899 ansible-collection-awx-awx: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65899 [MEDIUM] CVE-2026-65899 ansible-collection-awx-awx: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [epel-all]
CVE-2026-65899 ansible-collection-awx-awx: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trust
Bugzilla
CVE-2026-65899 nextcloud: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65899 [MEDIUM] CVE-2026-65899 nextcloud: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [fedora-all]
CVE-2026-65899 nextcloud: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink.
Bugzilla
CVE-2026-65899 jupyterlab: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65899 [MEDIUM] CVE-2026-65899 jupyterlab: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [epel-all]
CVE-2026-65899 jupyterlab: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. P
Bugzilla
CVE-2026-65899 fbthrift: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65899 [MEDIUM] CVE-2026-65899 fbthrift: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [epel-all]
CVE-2026-65899 fbthrift: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Pas
Bugzilla
CVE-2026-65899 grafana: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65899 [MEDIUM] CVE-2026-65899 grafana: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [fedora-all]
CVE-2026-65899 grafana: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Pa
Bugzilla
CVE-2026-65899 jupyterlab: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65899 [MEDIUM] CVE-2026-65899 jupyterlab: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [fedora-all]
CVE-2026-65899 jupyterlab: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink.
Bugzilla
CVE-2026-65899 forgejo: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65899 [MEDIUM] CVE-2026-65899 forgejo: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [epel-all]
CVE-2026-65899 forgejo: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Pass
Bugzilla
CVE-2026-65899 dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset
bugzilla·2026-07-23·CVSS 6.1
CVE-2026-65899 [MEDIUM] CVE-2026-65899 dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset
CVE-2026-65899 dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset
DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Passing TRUSTED_TYPES_POLICY: null on the later call also does not clear the retained policy.
2026-07-23
Published