PT-2026-64287

CVE-2026-66010

Published

2026-07-21

Updated

2026-08-06

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.4.12

Description DOMPurify fails to execute the afterSanitizeElements hook for custom elements that are permitted through CUSTOM ELEMENT HANDLING.tagNameCheck. This allows attributes to bypass application security policies, enabling attackers to preserve sensitive attributes on custom elements. These attributes can subsequently be re-injected into innerHTML sinks, resulting in second-order Cross-Site Scripting (XSS) gadgets. XSS is a type of attack where malicious scripts are injected into trusted websites.

Recommendations Update to version 3.4.12 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-184: Incomplete List of Disallowed Inputs

CWE-693: Protection Mechanism Failure

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')