Beveiligingsadvies

CVE-2026-65898

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-07-23 13:16:17

Laatst bijgewerkt 2026-07-23 15:47:13

Toegewezen door VulnCheck

CVSS-score 7.2

Status PUBLISHED

Beschrijving

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.

← Alle CVE's bekijken Bekijk op cve.org ↗