Security Bulletin: IBM Maximo Application Suite uses dompurify-3.4.7.tgz which is vulnerable to CVE-2026-66010

Summary IBM Maximo Application Suite uses dompurify-3.4.7.tgz which is vulnerable to CVE-2026-66010. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-66010 DESCRIPTION: DOMPurify before 3.4.12 fails to execute afterSanitizeElemen...

CVE-2026-66010: Improper Neutralization of Input During Web Page Generation

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into...