CVE-2026-66010

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.4.12

Description DOMPurify fails to execute the afterSanitizeElements hook for custom elements that are permitted through CUSTOM ELEMENT HANDLING.tagNameCheck. This allows attributes to bypass application security policies, enabling attackers to preserve sensitive attributes on custom elements. These attributes can subsequently be re-injected into innerHTML sinks, resulting in second-order Cross-Site Scripting (XSS) gadgets. XSS is a type of attack where malicious scripts are injected into trusted websites.

Recommendations Update to version 3.4.12 or later.