Trust Boundary Violation in DOMPurify - CVE-2026-65902
Published: May 27, 2026 / Updated: September 14, 2026
Vulnerability details
The vulnerability allows a remote attacker to bypass sanitization protections and inject disallowed HTML elements or attributes into sanitized output.
The vulnerability exists due to trust boundary violation in DOMPurify hook handling when processing hook callbacks that mutate data.allowedTags or data.allowedAttributes during sanitization with default configuration. A remote attacker can supply crafted content that is sanitized after a hook has widened the default allow-list to bypass sanitization protections and inject disallowed HTML elements or attributes into sanitized output.
User interaction is required to render attacker-influenced content, and the polluted allow-list persists for the lifetime of the DOMPurify instance until a new instance is created.