SUSE CVE-2026-65898

DOMPurify before 3.4.11 fails to clone the ALLOWEDATTR allowlist when setConfig is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements,...

EUVD-2026-48286

DOMPurify before 3.4.11 fails to clone the ALLOWEDATTR allowlist when setConfig is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements,...

CVE-2026-65898

DOMPurify before 3.4.11 is affected. The vulnerability arises when setConfig() is used with an uponSanitizeAttribute hook and the ALLOWED_ATTR allowlist isn’t cloned, allowing the hook to permanently mutate the shared allowlist. An attacker can register a hook that conditionally permits dangerous...

Improper Initialization

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Improper Initialization in the DOMPurify.setConfig API when an uponSanitizeAttribute hook is registered that mutates allowedAttributes. An attacker can cause persistent...