This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-65898 →

DEBIAN-CVE-2026-65898

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to pe...

Original description

The description as published by the source.

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 node-dompurify

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 node-dompurify

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 node-dompurify

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.12+dfsg-1"}]}]

References

advisory security-tracker.debian.org