CVE-2026-65911
published 2026-07-23CVE-2026-65911: In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING)…
PriorityP427medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.33%
25.5th percentile
In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can allow dangerous event-handler attributes or forbidden tags (bypassing FORBID_TAGS) to survive sanitization, resulting in cross-site scripting. The vendor (Cure53) considers this an edge case outside DOMPurify's threat model; the referenced advisory lists 3.4.0 as the patched version.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cure53 | dompurify | < 3.4.0 | 3.4.0 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv4.05.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-65911 jupyterlab: DOMPurify: Cross-site scripting due to state leakage in sanitization. [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65911 [MEDIUM] CVE-2026-65911 jupyterlab: DOMPurify: Cross-site scripting due to state leakage in sanitization. [fedora-all]
CVE-2026-65911 jupyterlab: DOMPurify: Cross-site scripting due to state leakage in sanitization. [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can
Bugzilla
CVE-2026-65911 jupyterlab: DOMPurify: Cross-site scripting due to state leakage in sanitization. [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65911 [MEDIUM] CVE-2026-65911 jupyterlab: DOMPurify: Cross-site scripting due to state leakage in sanitization. [epel-all]
CVE-2026-65911 jupyterlab: DOMPurify: Cross-site scripting due to state leakage in sanitization. [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can a
Bugzilla
CVE-2026-65911 ansible-collection-awx-awx: DOMPurify: Cross-site scripting due to state leakage in sanitization. [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65911 [MEDIUM] CVE-2026-65911 ansible-collection-awx-awx: DOMPurify: Cross-site scripting due to state leakage in sanitization. [epel-all]
CVE-2026-65911 ansible-collection-awx-awx: DOMPurify: Cross-site scripting due to state leakage in sanitization. [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or
Bugzilla
CVE-2026-65911 fbthrift: DOMPurify: Cross-site scripting due to state leakage in sanitization. [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65911 [MEDIUM] CVE-2026-65911 fbthrift: DOMPurify: Cross-site scripting due to state leakage in sanitization. [epel-all]
CVE-2026-65911 fbthrift: DOMPurify: Cross-site scripting due to state leakage in sanitization. [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can all
Bugzilla
CVE-2026-65911 fbthrift: DOMPurify: Cross-site scripting due to state leakage in sanitization. [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65911 [MEDIUM] CVE-2026-65911 fbthrift: DOMPurify: Cross-site scripting due to state leakage in sanitization. [fedora-all]
CVE-2026-65911 fbthrift: DOMPurify: Cross-site scripting due to state leakage in sanitization. [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can a
Bugzilla
CVE-2026-65911 cachelib: DOMPurify: Cross-site scripting due to state leakage in sanitization. [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65911 [MEDIUM] CVE-2026-65911 cachelib: DOMPurify: Cross-site scripting due to state leakage in sanitization. [epel-all]
CVE-2026-65911 cachelib: DOMPurify: Cross-site scripting due to state leakage in sanitization. [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can all
Bugzilla
CVE-2026-65911 cachelib: DOMPurify: Cross-site scripting due to state leakage in sanitization. [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65911 [MEDIUM] CVE-2026-65911 cachelib: DOMPurify: Cross-site scripting due to state leakage in sanitization. [fedora-all]
CVE-2026-65911 cachelib: DOMPurify: Cross-site scripting due to state leakage in sanitization. [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can a
Bugzilla
CVE-2026-65911 forgejo: DOMPurify: Cross-site scripting due to state leakage in sanitization. [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65911 [MEDIUM] CVE-2026-65911 forgejo: DOMPurify: Cross-site scripting due to state leakage in sanitization. [epel-all]
CVE-2026-65911 forgejo: DOMPurify: Cross-site scripting due to state leakage in sanitization. [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can allo
Bugzilla
CVE-2026-65911 nextcloud: DOMPurify: Cross-site scripting due to state leakage in sanitization. [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65911 [MEDIUM] CVE-2026-65911 nextcloud: DOMPurify: Cross-site scripting due to state leakage in sanitization. [fedora-all]
CVE-2026-65911 nextcloud: DOMPurify: Cross-site scripting due to state leakage in sanitization. [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can
Bugzilla
CVE-2026-65911 grafana: DOMPurify: Cross-site scripting due to state leakage in sanitization. [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65911 [MEDIUM] CVE-2026-65911 grafana: DOMPurify: Cross-site scripting due to state leakage in sanitization. [fedora-all]
CVE-2026-65911 grafana: DOMPurify: Cross-site scripting due to state leakage in sanitization. [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can al
Bugzilla
CVE-2026-65911 nextcloud: DOMPurify: Cross-site scripting due to state leakage in sanitization. [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65911 [MEDIUM] CVE-2026-65911 nextcloud: DOMPurify: Cross-site scripting due to state leakage in sanitization. [epel-all]
CVE-2026-65911 nextcloud: DOMPurify: Cross-site scripting due to state leakage in sanitization. [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can al
Bugzilla
CVE-2026-65911 forgejo: DOMPurify: Cross-site scripting due to state leakage in sanitization. [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65911 [MEDIUM] CVE-2026-65911 forgejo: DOMPurify: Cross-site scripting due to state leakage in sanitization. [fedora-all]
CVE-2026-65911 forgejo: DOMPurify: Cross-site scripting due to state leakage in sanitization. [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can al
Bugzilla
CVE-2026-65911 DOMPurify: DOMPurify: Cross-site scripting due to state leakage in sanitization.
bugzilla·2026-07-23·CVSS 6.1
CVE-2026-65911 [MEDIUM] CVE-2026-65911 DOMPurify: DOMPurify: Cross-site scripting due to state leakage in sanitization.
CVE-2026-65911 DOMPurify: DOMPurify: Cross-site scripting due to state leakage in sanitization.
In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can allow dangerous event-handler attributes or forbidden tags (bypassing FORBID_TAGS) to survive sanitization, resulting in cross-site scripting. The vendor (Cure53) considers this an edge case outside DOMPurify's threat model; the reference
2026-07-23
Published