CVE-2026-65898

A flaw was found in DOMPurify. When the setConfig() function is used with an uponSanitizeAttribute hook, the ALLOWED_ATTR allowlist is not properly cloned. This allows an attacker to register a hook that can permanently modify the shared allowlist, enabling the conditional allowance of dangerous attributes. Consequently, an attacker can submit untrusted content that inherits the polluted allowlist, leading to stored Cross-site Scripting (XSS) and the execution of event handlers.

This vulnerability in DOMPurify allows for cross-site scripting due to improper handling of the ALLOWED_ATTR allowlist. When the setConfig() function is used with an uponSanitizeAttribute hook, the allowlist can be permanently mutated, enabling attackers to inject dangerous attributes and execute stored XSS.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.