CVE-2026-65912

A flaw was found in DOMPurify. An attacker can bypass URI validation by providing a specially crafted predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. This allows unsafe protocols, such as javascript:, to persist after sanitization, potentially leading to DOM-based cross-site scripting (XSS) when a user activates a malicious link.

This cross-site scripting (XSS) vulnerability in DOMPurify arises when applications configure ADD_ATTR as a predicate function through EXTRA_ELEMENT_HANDLING.attributeCheck. An attacker could exploit this by crafting malicious input that bypasses URI validation, leading to the execution of unsafe javascript: protocols upon user interaction with a crafted link. This requires a specific, non-default configuration of the DOMPurify library within affected Red Hat products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.