CVEFinder.io

CVE-2026-65913

🔶 medium
🔍 Scan for this CVE
Summary

DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.

CVSS Score
6.1
Medium
EPSS Score
0.2
Exploit Probability
Published Date
2026-07-23
First Seen: 2026-07-31
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 38.4% of all 340,405 vulnerabilities in our database.

#209,770
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jul 23, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
🏆 Discovered By
christos-eth (reporter)
SSVC data provided by CISA
Last Modified 2026-07-28
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS Vector 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE IDs (Weakness Types)

📦 Affected Products 1

🔗 References 2

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-65898 ⚠️ high 7.2 0.2 DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute... 2026-07-23
CVE-2026-65899 🔶 medium 6.1 0.2 DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPuri... 2026-07-23
CVE-2026-65900 🔶 medium 6.1 0.2 DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RE... 2026-07-23
CVE-2026-65901 🔶 medium 6.1 0.2 DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled n... 2026-07-23
CVE-2026-65902 🔶 medium 6.1 0.2 DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS an... 2026-07-23
CVE-2026-65903 🔶 medium 6.1 0.2 DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden t... 2026-07-23
These CVEs affect the same products