CVE-2026-66010

A flaw was found in DOMPurify. This vulnerability allows attackers to bypass application security policies by preserving sensitive attributes on custom elements. These attributes can then be re-injected into web page content, leading to Cross-Site Scripting (XSS) attacks. An attacker could exploit this to execute malicious scripts in a user's browser, potentially leading to information disclosure or unauthorized actions.

This Moderate-impact flaw in DOMPurify allows for Cross-Site Scripting (XSS) attacks by enabling the bypass of sanitization policies for custom elements. An attacker could exploit this by crafting malicious content that, when processed by affected Red Hat products utilizing DOMPurify in their web interfaces, could lead to the execution of arbitrary client-side scripts. This could result in information disclosure or unauthorized actions within the user's browser session.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.