CVE-2026-65911

In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can allow dangerous event-handler attributes or forbidden tags (bypassing FORBID_TAGS) to survive sanitization, resulting in cross-site scripting. The vendor (Cure53) considers this an edge case outside DOMPurify's threat model; the referenced advisory lists 3.4.0 as the patched version.

• CWE-79

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-9p3w-6h5p-cv75Exploit, Third Party Advisory
• https://www.vulncheck.com/advisories/dompurify-before-xss-via-add-attr-add-tags-state-leakageThird Party Advisory

Published

Jul 23, 2026

Last Modified

Jul 28, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-65903DOMPurify before 3.4.0 contains a logic error in the ADD_TAG…6.1
• CVE-2026-65904DOMPurify through 3.3.3 fails to sanitize DOM elements passe…4.7
• CVE-2026-65906In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execut…10
• CVE-2026-65907In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execut…9.1
• CVE-2026-65908In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code …8.6
• CVE-2026-6591A flaw has been found in ComfyUI up to 0.13.0. Affected is t…4.3
• CVE-2026-65912DOMPurify before 3.3.2 contains a URI validation bypass vuln…6.1
• CVE-2026-65913DOMPurify before 3.3.2 contains a prototype pollution vulner…6.1
• CVE-2026-65914DOMPurify before 3.3.2 contains a mutation-XSS vulnerability…6.1
• CVE-2026-65916CyberPanel through 1.9.1, fixed in commit b198460, contains …8.1
• CVE-2026-65917CyberPanel through 1.9.1, fixed in commit b198460, contains …8.8
• CVE-2026-65918PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2,…7.1