CVE-2026-65903

MEDIUM

DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS

Title source: cna
STIX 2.1

Description

DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.

References (2)

Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-39q2-94rc-95cp)
https://github.com/cure53/DOMPurify/security/advisories/GHSA-39q2-94rc-95cp
Third Party Advisory third-party-advisory
VulnCheck Advisory: DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS
https://www.vulncheck.com/advisories/dompurify-before-add-tags-function-bypasses-forbid-tags

Scores

CVSS v3 6.1
EPSS 0.0020
EPSS Percentile 10.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-697
Status published
Products (4)
cure53/DOMPurify < 3.4.0
cure53/dompurify < 3.4.0
cure53/DOMPurify 3.4.0
npm/dompurify 0 - 3.4.0npm
Published Jul 23, 2026
Tracked Since Jul 23, 2026