CVE-2026-66010

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into innerHTML sinks, creating second-order XSS gadgets.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/cure53/DOMPurify/security/advisories/GHSA-c2j3-45gr-mqc4	Exploit Vendor Advisory
https://www.vulncheck.com/advisories/dompurify-before-hook-bypass-via-custom-element-handling	Third Party Advisory
https://github.com/cure53/DOMPurify/security/advisories/GHSA-c2j3-45gr-mqc4	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) DOMPurify anterior a la versión 3.4.12 falla al ejecutar el hook afterSanitizeElements para elementos personalizados permitidos a través de CUSTOM_ELEMENT_HANDLING.tagNameCheck, permitiendo que los atributos eludan las políticas de seguridad de la aplicación. Los atacantes pueden preservar atributos sensibles en elementos personalizados que luego los reinyectan en sumideros de innerHTML, creando gadgets XSS de segundo orden.

Information

Published : 2026-07-24 13:18

Updated : 2026-10-24 13:10

NVD link : CVE-2026-66010

Mitre link : CVE-2026-66010

CVE.ORG link : CVE-2026-66010

JSON object : View

Products Affected

cure53

dompurify

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-66010", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66010", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-24T14:13:53.590696Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "cure53", "product": "DOMPurify", "versions": [{"status": "affected", "version": "0", "lessThan": "3.4.12", "versionType": "semver"}, {"status": "unaffected", "version": "3.4.12", "versionType": "semver"}], "packageURL": "pkg:npm/DOMPurify", "defaultStatus": "unaffected"}]}], "published": "2026-07-24T13:18:28.720", "references": [{"url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-c2j3-45gr-mqc4", "tags": ["Exploit", "Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/dompurify-before-hook-bypass-via-custom-element-handling", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-c2j3-45gr-mqc4", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into innerHTML sinks, creating second-order XSS gadgets."}, {"lang": "es", "value": "DOMPurify anterior a la versi\u00f3n 3.4.12 falla al ejecutar el hook afterSanitizeElements para elementos personalizados permitidos a trav\u00e9s de CUSTOM_ELEMENT_HANDLING.tagNameCheck, permitiendo que los atributos eludan las pol\u00edticas de seguridad de la aplicaci\u00f3n. Los atacantes pueden preservar atributos sensibles en elementos personalizados que luego los reinyectan en sumideros de innerHTML, creando gadgets XSS de segundo orden."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "268D57E6-2C1D-4BA2-92CD-8BEE491E69F7", "versionEndExcluding": "3.4.12"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}