Bug 2506429 (CVE-2026-65913)

Summary: CVE-2026-65913 dompurify: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abarbaro, akhatavk, akostadi, alizardo, amasferr, amctagga, anjoseph, anpicker, aoconnor, aos-team-art-private, asdas, ataylor, bniver, bparees, cdrage, dbruscin, dkeler, dmayorov, dpaolell, dschmidt, ehugonne, ewittman, flucifre, fmariani, gmalinko, gmeno, gparvin, groman, hasun, janstey, jchui, jdelft, jfula, jhe, jlanda, jlledo, jowilson, jprabhak, jupierce, jwong, jwon, kaycoth, kbempah, kshier, ktsao, kvanderr, lchilton, lgarciaa, mbenjamin, mbiarnes, mcarlett, mhackett, nboldt, nipatil, nyancey, oaljalju, omaciel, ometelka, pantinor, pjindal, ppalepu, ppostler, prdhamdh, psrna, ptisnovs, rhaigner, rhel-process-autobot, rkubis, rstepani, rushinde, sdawley, sfeifer, sghai, sidsharm, simaishi, solenoci, sostapov, stcannon, suppawar, syedriko, tcunning, teagle, thason, tsedmik, ttakamiy, vereddy, vlaad, watson-tool-maintainers, wtam, xdharmai, yfang, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in DOMPurify. This prototype pollution vulnerability, specifically when operating in USE_PROFILES mode, allows a remote attacker to bypass attribute filtering. By manipulating Array.prototype properties, an attacker can cause DOMPurify to accept event handlers as allowed attributes, leading to DOM-based Cross-Site Scripting (XSS) when the sanitized markup is rendered. This could result in the execution of malicious scripts in the user's browser.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2520426, 2520429, 2520444, 2520447, 2520452, 2520474, 2520508, 2520509, 2520513, 2520514, 2520515, 2520516, 2520437, 2520449, 2520454, 2520461, 2520467, 2520477, 2520510, 2520511, 2520512, 2520517, 2520521, 2520529    
Bug Blocks:    

Description OSIDB Bzimport 2026-07-23 14:01:35 UTC 
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.