Is CVE-2026-65898 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-65898?

CVE-2026-65898 has a CVSS v3 severity of HIGH (7.2).

Back

CVE-2026-65898

Description

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.