CVE-2026-65912

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.3.2

Description A URI validation bypass occurs when ADD ATTR is used as a predicate function through EXTRA ELEMENT HANDLING.attributeCheck. This allows attackers to provide a predicate that accepts specific attribute and tag combinations, bypassing URI-safe validation. Consequently, unsafe protocols such as javascript: can bypass sanitization, leading to DOM-based Cross-Site Scripting (XSS)—a vulnerability where malicious scripts are executed in the browser—when the link is activated.

Recommendations Update to version 3.3.2 or later. Restrict the use of the EXTRA ELEMENT HANDLING.attributeCheck predicate function to minimize the risk of exploitation.