Bug 2506427 (CVE-2026-65912)

Summary:	CVE-2026-65912 dompurify: DOMPurify: URI validation bypass leads to cross-site scripting
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abarbaro, akhatavk, akostadi, alizardo, amasferr, amctagga, anjoseph, anpicker, aoconnor, aos-team-art-private, asdas, ataylor, bniver, bparees, cdrage, dbruscin, dkeler, dmayorov, dpaolell, dschmidt, ehugonne, ewittman, flucifre, fmariani, gmalinko, gmeno, gparvin, groman, hasun, janstey, jchui, jdelft, jfula, jhe, jlanda, jlledo, jowilson, jprabhak, jupierce, jwong, jwon, kaycoth, kbempah, kshier, ktsao, kvanderr, lchilton, lgarciaa, mbenjamin, mbiarnes, mcarlett, mhackett, nboldt, nipatil, nyancey, oaljalju, omaciel, ometelka, pantinor, pjindal, ppalepu, ppostler, prdhamdh, psrna, ptisnovs, rhaigner, rhel-process-autobot, rkubis, rstepani, rushinde, sdawley, sfeifer, sghai, sidsharm, simaishi, solenoci, sostapov, stcannon, suppawar, syedriko, tcunning, teagle, thason, tsedmik, ttakamiy, vereddy, vlaad, watson-tool-maintainers, wtam, xdharmai, yfang, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in DOMPurify. An attacker can bypass URI validation by providing a specially crafted predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. This allows unsafe protocols, such as javascript:, to persist after sanitization, potentially leading to DOM-based cross-site scripting (XSS) when a user activates a malicious link.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2520356, 2520359, 2520360, 2520363, 2520364, 2520366, 2520357, 2520358, 2520361, 2520362, 2520365, 2520367
Bug Blocks:

Description OSIDB Bzimport 2026-07-23 14:01:28 UTC

DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe protocols like javascript: to survive sanitization and execute as DOM-based XSS when the link is activated.