Security Bulletin: IBM DataPower Gateway affected by cross-site scripting due to DOMPurify (CVE-2026-66010)

Summary IBM DataPower Gateway has addressed CVE-2026-66010 in 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-66010 DESCRIPTION: DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing...

Astra Linux – Vulnerability in Chromium

Before version 106.0.5249.91, using “after free” in Custom Elements in Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in DOMPurify

Summary The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in DOMPurify. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-66010 DESCRIPTION: DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom...

Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-66010, CVE-2026-54515, CVE-2026-59889, CVE-2026-49844, CVE-2026-69153)

Summary Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite CVE-2026-66010, CVE-2026-54515, CVE-2026-59889, CVE-2026-49844, CVE-2026-69153. Vulnerability Details CVEID:CVE-2026-66010 DESCRIPTION: DOMPurify before 3.4.12 fails to execute...

SUSE CVE-2026-66010

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into...

Cross-site Scripting (XSS)

DOMPurify is vulnerable to Cross-site Scripting XSS. The vulnerability is due to failure to execute the afterSanitizeElements hook for custom elements allowed through CUSTOMELEMENTHANDLING.tagNameCheck, allowing sensitive attributes to bypass sanitization and be reused in innerHTML sinks to execu...

Linux Distros Unpatched Vulnerability : CVE-2026-66010

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing attributes to...

CVE-2026-66010

A flaw was found in DOMPurify. This vulnerability allows attackers to bypass application security policies by preserving sensitive attributes on custom elements. These attributes can then be re-injected into web page content, leading to Cross-Site Scripting XSS attacks. An attacker could exploit...

CVE-2026-66010

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into...

DEBIAN-CVE-2026-66010

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into...

UBUNTU-CVE-2026-66010

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into...

CVE-2026-66010

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into...

CVE-2026-66010 DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into...

CVE-2026-66010 DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into...

CVE-2026-66010

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into...

CVE-2026-66010 DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into...

CVE-2026-66010

DOMPurify before 3.4.12 has a vulnerability where afterSanitizeElements is not executed for custom elements allowed by CUSTOM_ELEMENT_HANDLING.tagNameCheck, enabling attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements and later re-inj...

EUVD-2026-48582

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into...

PT-2026-105528

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c2j3-45gr-mqc4. This link is maintained to preserve external references. Original Description DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM ELEMENT...

PT-2026-64287

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.4.12 Description DOMPurify fails to execute the afterSanitizeElements hook for custom elements that are permitted through CUSTOM ELEMENT HANDLING.tagNameCheck. This allows attributes to bypass application security...