CVE-2026-65913
published 2026-07-23CVE-2026-65913: DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting…
PriorityP429medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.32%
23.4th percentile
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cure53 | dompurify | < 3.3.2 | 3.3.2 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv4.05.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-65913 fbthrift: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65913 [MEDIUM] CVE-2026-65913 fbthrift: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [fedora-all]
CVE-2026-65913 fbthrift: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
Bugzilla
CVE-2026-65913 jupyterlab: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65913 [MEDIUM] CVE-2026-65913 jupyterlab: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [epel-all]
CVE-2026-65913 jupyterlab: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
Bugzilla
CVE-2026-65913 fbthrift: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65913 [MEDIUM] CVE-2026-65913 fbthrift: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [epel-all]
CVE-2026-65913 fbthrift: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
Bugzilla
CVE-2026-65913 cachelib: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65913 [MEDIUM] CVE-2026-65913 cachelib: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [fedora-all]
CVE-2026-65913 cachelib: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
Bugzilla
CVE-2026-65913 ansible-collection-awx-awx: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65913 [MEDIUM] CVE-2026-65913 ansible-collection-awx-awx: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [epel-all]
CVE-2026-65913 ansible-collection-awx-awx: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
Bugzilla
CVE-2026-65913 jupyterlab: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65913 [MEDIUM] CVE-2026-65913 jupyterlab: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [fedora-all]
CVE-2026-65913 jupyterlab: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
Bugzilla
CVE-2026-65913 forgejo: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65913 [MEDIUM] CVE-2026-65913 forgejo: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [fedora-all]
CVE-2026-65913 forgejo: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
Bugzilla
CVE-2026-65913 forgejo: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65913 [MEDIUM] CVE-2026-65913 forgejo: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [epel-all]
CVE-2026-65913 forgejo: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
Bugzilla
CVE-2026-65913 nextcloud: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65913 [MEDIUM] CVE-2026-65913 nextcloud: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [fedora-all]
CVE-2026-65913 nextcloud: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
Discussion:
This bug is not valid. As of this writing, the current
Bugzilla
CVE-2026-65913 grafana: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65913 [MEDIUM] CVE-2026-65913 grafana: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [fedora-all]
CVE-2026-65913 grafana: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
Bugzilla
CVE-2026-65913 cachelib: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65913 [MEDIUM] CVE-2026-65913 cachelib: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [epel-all]
CVE-2026-65913 cachelib: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
Bugzilla
CVE-2026-65913 nextcloud: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65913 [MEDIUM] CVE-2026-65913 nextcloud: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [epel-all]
CVE-2026-65913 nextcloud: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
Discussion:
This bug is not valid. As of this writing, the current N
Bugzilla
CVE-2026-65913 dompurify: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode
bugzilla·2026-07-23·CVSS 6.1
CVE-2026-65913 [MEDIUM] CVE-2026-65913 dompurify: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode
CVE-2026-65913 dompurify: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
2026-07-23
Published