CVE-2026-65902

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.4.7

Description When the sanitize function is called without an explicit cfg.ALLOWED TAGS or cfg.ALLOWED ATTR array, direct references to the module-level DEFAULT ALLOWED TAGS and DEFAULT ALLOWED ATTR sets are passed to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags and data.allowedAttributes. If a hook mutates these fields, it permanently expands the default allow-lists for the duration of the DOMPurify instance. Consequently, subsequent calls using the default configuration inherit these widened defaults, allowing attacker payloads containing the poisoned tag or attribute names to bypass sanitization. The state cannot be recovered using removeAllHooks(), clearConfig(), or by passing a new configuration; only the creation of a new DOMPurify instance resolves the state.

Recommendations Update to version 3.4.7 or later.