TI-2026-46949 Aliases CVE-2026-65911

DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage

LOW 29CWE-79Published 2026-07-23 · Updated 2026-07-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: Active
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · None · None
Fix status: Partial Red Hat: 1 fixed, 29 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-79.

Summary

In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can allow dangerous event-handler attributes or forbidden tags (bypassing FORBID_TAGS) to survive sanitization, resulting in cross-site scripting. The vendor (Cure53) considers this an edge case outside DOMPurify's threat model; the referenced advisory lists 3.4.0 as the patched version.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00333 26th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial DOMPurify (cure53): 3.4.0Red Hat: 2 advisoriesRed Hat: 1 fixed, 29 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
cure53	DOMPurify	before 3.4.0	3.4.0	Patch available	CNA

DOMPurify Vendorcure53 Affected before 3.4.0 Fixed in 3.4.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cure53:dompurify::::::::	before 3.4.0	Vulnerable	cure53

cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:* Versions before 3.4.0 Vulnerable ·cure53

Remediation

Fix · CNA DOMPurify (cure53) Fixed in 3.4.0

Red Hat 2 advisories

RHSA-2026:58500 Released 2026-08-22 · Red Hat rating Moderate
Red Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images grafana12.4-12.4.8-0.1.2.hum1@aarch64, grafana12.4-12.4.8-0.1.2.hum1@src, grafana12.4-12.4.8-0.1.2.hum1@x86_64
RHSA-2026:54517 Released 2026-08-13 · Red Hat rating Important
Red Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images grafana13.1-13.1.3-0.1.1.hum1@aarch64, grafana13.1-13.1.3-0.1.1.hum1@src, grafana13.1-13.1.3-0.1.1.hum1@x86_64

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-07-23
cure53 DOMPurify 3.4.0
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-46943 DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGSPriority LOW 23
Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Migration Toolkit for Virtualization	Affected	No fix yet: Fix deferred
Multicluster Engine for Kubernetes	Affected	No fix yet: Fix deferred
Node HealthCheck Operator	Affected	No fix yet: Fix deferred
OpenShift Lightspeed	Affected	No fix yet: Fix deferred
OpenShift Service Mesh 3	Affected	No fix yet: Fix deferred
Red Hat 3scale API Management Platform 2	Affected	No fix yet: Fix deferred
Red Hat AMQ Broker 7	Affected	No fix yet: Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2	Affected	No fix yet: Fix deferred
Red Hat Advanced Cluster Security 4	Affected	No fix yet: Fix deferred
Red Hat Ansible Automation Platform 2	Affected	No fix yet: Fix deferred
Red Hat Build of Podman Desktop	Affected	No fix yet: Fix deferred
Red Hat Ceph Storage 6	Affected	No fix yet: Fix deferred
Red Hat Ceph Storage 8	Affected	No fix yet: Fix deferred
Red Hat Ceph Storage 9	Affected	No fix yet: Fix deferred
Red Hat Data Grid 8	Affected	No fix yet: Fix deferred
Red Hat Developer Hub 1	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred
Red Hat OpenShift Container Platform 5	Affected	No fix yet: Fix deferred
Red Hat OpenShift Dev Spaces	Affected	No fix yet: Fix deferred
Red Hat OpenShift GitOps	Affected	No fix yet: Fix deferred
Red Hat OpenShift Virtualization 4	Affected	No fix yet: Fix deferred
Red Hat Openshift Data Foundation 4	Affected	No fix yet: Fix deferred
Red Hat build of Apache Camel for Spring Boot 4	Affected	No fix yet: Fix deferred
Red Hat build of Apicurio Registry 3	Affected	No fix yet: Fix deferred
Self-service automation portal 2	Affected	No fix yet: Fix deferred
Red Hat Hardened Images	Fixed	RHSA-2026:54517, RHSA-2026:58500

Not affected: 4 products

Ansible Automation Orchestrator 2026
Red Hat Ansible Automation Platform 2
Red Hat Enterprise Linux 10
Red Hat Hardened Images

Timeline

2026-10-02 Threatist record created from CVE-2026-65911
2026-10-12 Affected versions changed · Red Hat
2026-10-27 Affected versions changed · Red Hat
2026-11-06 Affected versions changed · Red Hat

References

Exploit 1

GitHub Security Advisory (GHSA-9p3w-6h5p-cv75)

TI-2026-34986 DOMPurify XSS via `selectedcontent` re-clone CVSS 3.1HIGH 8.2
TI-2026-36811 DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content CVSS 4.0MEDIUM 6.3
TI-2026-36614 DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM CVSS 3.1MEDIUM 6.1
TI-2026-36613 DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks CVSS 3.1MEDIUM 6.1
TI-2026-29849 DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) CVSS 4.0MEDIUM 6.0
TI-2025-19705 Cross-site scripting in cure53 DOMPurify CVSS 3.1MEDIUM 6.1

See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences