Bug 2506731 (CVE-2026-66010) - CVE-2026-66010 dompurify: DOMPurify: Cross-Site Scripting (XSS) via custom element attribute bypass
Summary: CVE-2026-66010 dompurify: DOMPurify: Cross-Site Scripting (XSS) via custom el...
Keywords:
Status: NEW
Alias: CVE-2026-66010
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2506835 2506836 2506838 2506839 2506840 2506842 2506846 2506848 2506837 2506841 2506843 2506844 2506845 2506847 2506849 2506850 2509213 2509214
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-24 13:02 UTC by OSIDB Bzimport
Modified: 2026-08-31 10:28 UTC (History)
105 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-24 13:02:21 UTC 
DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into innerHTML sinks, creating second-order XSS gadgets.
Note You need to log in before you can comment on or make changes to this bug.