NPM: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.

NPM: DOMPurify: CUSTOMELEMENTHANDLING bypasses afterSanitizeElements for allowed custom elements. vulnerability discovered by ? in WordPress Npm dompurify versions = 3.4.11...

Incomplete List of Disallowed Inputs

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the CUSTOMELEMENTHANDLING. An attacker can cause security-relevant attributes to be preserved on allowed custom elements by leveragi...

GHSA-C2J3-45GR-MQC4 DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.

Summary There is a possible hook-policy inconsistency in DOMPurify 3.4.11 involving CUSTOMELEMENTHANDLING. When a custom element is allowed via CUSTOMELEMENTHANDLING.tagNameCheck, it appears that the element does not go through afterSanitizeElements in the same way as a normal element. As a resul...

Incomplete List of Disallowed Inputs

Overview org.webjars.npm:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the CUSTOMELEMENTHANDLING. An attacker can cause security-relevant attributes to be preserved on allowed custom...

DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.

Summary There is a possible hook-policy inconsistency in DOMPurify 3.4.11 involving CUSTOMELEMENTHANDLING. When a custom element is allowed via CUSTOMELEMENTHANDLING.tagNameCheck, it appears that the element does not go through afterSanitizeElements in the same way as a normal element. As a resul...

CVE-2026-41238

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses DOMPurify.sanitize with the default configuration no CUSTOMELEMENTHANDLING option, a prior prototype...

CVE-2026-41238 DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses DOMPurify.sanitize with the default configuration no CUSTOMELEMENTHANDLING option, a prior prototype...

CVE-2026-41238

DOMPurify is vulnerable to a prototype-pollution-based XSS bypass in versions 3.0.1–3.3.3 when using the default sanitize() config (no CUSTOM_ELEMENT_HANDLING). A polluted Object.prototype can inject permissive tagNameCheck and attributeNameCheck values, allowing arbitrary custom elements with ev...

DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback

Summary DOMPurify versions 3.0.1 through 3.3.3 latest are vulnerable to a prototype pollution-based XSS bypass. When an application uses DOMPurify.sanitize with the default configuration no CUSTOMELEMENTHANDLING option, a prior prototype pollution gadget can inject permissive tagNameCheck and...

GHSA-V9JR-RG53-9PGP DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback

Summary DOMPurify versions 3.0.1 through 3.3.3 latest are vulnerable to a prototype pollution-based XSS bypass. When an application uses DOMPurify.sanitize with the default configuration no CUSTOMELEMENTHANDLING option, a prior prototype pollution gadget can inject permissive tagNameCheck and...

Cross-site Scripting (XSS)

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS leading to cross-site scripting, via custom elements. When CUSTOMELEMENTHANDLING is not enabled, and an attacker has already polluted the prototype...

PT-2026-34602

Name of the Vulnerable Software and Affected Versions DOMPurify versions 3.0.1 through 3.3.3 Description DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. A prototype pollution-based XSS bypass exists when the DOMPurify.sanitize function is used with the default...