CVE-2026-65913

A flaw was found in DOMPurify. This prototype pollution vulnerability, specifically when operating in USE_PROFILES mode, allows a remote attacker to bypass attribute filtering. By manipulating Array.prototype properties, an attacker can cause DOMPurify to accept event handlers as allowed attributes, leading to DOM-based Cross-Site Scripting (XSS) when the sanitized markup is rendered. This could result in the execution of malicious scripts in the user's browser.

This flaw in DOMPurify allows for Cross-Site Scripting (XSS) when the library is configured to use USE_PROFILES mode. An attacker could exploit a prototype pollution vulnerability to bypass attribute filtering, enabling the execution of arbitrary JavaScript within the user's browser upon rendering of sanitized markup. This impacts Red Hat products that integrate DOMPurify for HTML sanitization in web applications and explicitly enable the vulnerable USE_PROFILES mode.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.