CVE-2026-65913

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.3.2

Description When operating in USE PROFILES mode, the software is susceptible to prototype pollution. This occurs when attackers pollute Array.prototype properties, such as setting onclick to true, to bypass attribute filtering. Consequently, the system may accept event handlers as allowlisted attributes, leading to DOM-based Cross-Site Scripting (XSS), where malicious scripts are executed in the browser when sanitized markup is rendered.

Recommendations Update to version 3.3.2 or later.