CVE-2026-65913 DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES
Attackers can bypass attribute filtering in DOMPurify's USE_PROFILES mode via prototype pollution, leading to DOM-based XSS when sanitized markup is rendered.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-65913?
CVE-2026-65913 is a medium-severity cross-site scripting vulnerability in cure53 DOMPurify, published on 23 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
Weakness: CWE-1321
Which versions are affected by CVE-2026-65913?
2 open source packages ship an affected version, including dompurify. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
dompurify npm | All versions | 3.3.2 |
dompurify npm | All versions | 3.3.2 |
Products include Cure53 Dompurify.
How do I fix CVE-2026-65913?
Upgrade dompurify to 3.3.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-65913 being exploited?
There is no known exploitation of CVE-2026-65913 in the wild and no public exploit code.
Other vulnerabilities in cure53 DOMPurify
- CVE-2024-47875 DOMPurify nesting-based mXSS
- CVE-2024-48910 DOMPurify vulnerable to tampering by prototype polution
- CVE-2026-47423 DOMPurify XSS via `selectedcontent` re-clone
- CVE-2024-45801 Tampering by prototype polution in DOMPurify
- CVE-2026-49978 DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
Sources
Also known as CLEANSTART-2026-WK70378, DEBIAN-CVE-2026-65913, ECHO-94be-5b66-d788, GHSA-cj63-jhhr-wcxv, MINI-2cj9-vpvv-m9xr, MINI-4m8w-9x67-w2qm and 10 more.