CVE-2026-65899

A flaw was found in DOMPurify where the clearConfig() function does not properly reset the retained Trusted Types policy. This can lead to a DOMPurify instance, when reused across different security contexts, remaining bound to a previously supplied and potentially unsafe policy. An attacker could leverage this to execute malicious scripts, resulting in client-side arbitrary code execution.

This flaw in DOMPurify, concerning improper Trusted Types policy reset, could lead to client-side arbitrary code execution. However, Red Hat products are not affected by this vulnerability, as indicated by the delegated resolution for the ruff component within Red Hat Hard Hat Images.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.