CVE-2026-65911

A flaw was found in DOMPurify. This vulnerability allows a remote attacker to perform cross-site scripting (XSS) by exploiting a state leakage issue. Specifically, function predicates used for adding attributes or tags during sanitization can persist across multiple calls to the sanitize() function. This persistence can lead to the approval of attacker-controlled attributes or tags, bypassing security filters and enabling the execution of malicious scripts in a user's browser.

Moderate: A cross-site scripting (XSS) vulnerability was found in DOMPurify. This flaw occurs when DOMPurify.sanitize() is called on the same instance with function predicates for ADD_ATTR or ADD_TAGS, followed by a call using array predicates. This specific usage pattern can lead to the persistence of previously defined function handlers, allowing malicious attributes or tags to bypass sanitization. Red Hat products that utilize DOMPurify in such a dynamic configuration may be susceptible to XSS attacks.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, applications utilizing DOMPurify should avoid reusing the same DOMPurify instance when dynamically switching between function and array predicates for ADD_ATTR or ADD_TAGS. Instead, a new DOMPurify instance should be initialized whenever the type of these predicates changes to ensure proper state reset.