Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-65899— DOMPurify before 3.4.9 Trusted Types Policy State Contamination

CVSS 6.1 · Medium

Possible ATT&CK Techniques 1AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

VendorProductVersion RangeStatus
cure53DOMPurify< 3.4.9affected
3.4.9unaffected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-65899

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
DOMPurify before 3.4.9 Trusted Types Policy State Contamination
Source: CVE Program / CVE List V5
Vulnerability Description
DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Passing TRUSTED_TYPES_POLICY: null on the later call also does not clear the retained policy.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
保护机制失效
Source: CVE Program / CVE List V5

Affected Products

VendorProductAffected VersionsCPESubscribe
cure53DOMPurify 0 ~ 3.4.9 -

II. Public POCs for CVE-2026-65899

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-65899

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-65899 (1)

Vendor Advisories for CVE-2026-65899 (1)

Other References for CVE-2026-65899 (1)

Same Patch Batch · cure53 · 2026-07-23 · 11 CVEs total

CVE-2026-658987.2 HIGHDOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig
CVE-2026-659016.1 MEDIUMDOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName
CVE-2026-659006.1 MEDIUMDOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM
CVE-2026-659126.1 MEDIUMDOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR
CVE-2026-659136.1 MEDIUMDOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES
CVE-2026-659116.1 MEDIUMDOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage
CVE-2026-659036.1 MEDIUMDOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS
CVE-2026-659026.1 MEDIUMDOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags
CVE-2026-659145.3 MEDIUMDOMPurify before 3.3.2 Mutation XSS via Re-Contextualization
CVE-2026-659044.7 MEDIUMDOMPurify before 3.4.4 Cross-Site Scripting via IN_PLACE mode

IV. Related Vulnerabilities

Same product: DOMPurify
Same vendor: cure53
Same weakness: CWE-693

V. Comments for CVE-2026-65899

No comments yet

Leave a comment