{"id":"GHSA-39q2-94rc-95cp","revision":"6d13b01a418d4815a2beb831ed417188","records":[{"revision":"6d13b01a418d4815a2beb831ed417188","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-39q2-94rc-95cp","aliases":["CVE-2026-65903"],"title":"DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation","description":"## Summary\nIn `src/purify.ts:1117-1123`, `ADD_TAGS` as a function (via `EXTRA_ELEMENT_HANDLING.tagCheck`) bypasses `FORBID_TAGS` due to short-circuit evaluation.\n\nThe condition:\n```\n!(tagCheck(tagName)) && (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName])\n```\nWhen `tagCheck(tagName)` returns `true`, the entire condition is `false` and the element is kept — `FORBID_TAGS[tagName]` is never evaluated.\n\n## Inconsistency\nThis contradicts the attribute-side pattern at line 1214 where `FORBID_ATTR` explicitly wins first:\n```\nif (FORBID_ATTR[lcName]) { continue; }\n```\nFor tags, FORBID should also take precedence over ADD.\n\n## Impact\nApplications using both `ADD_TAGS` as a function and `FORBID_TAGS` simultaneously get unexpected behavior — forbidden tags are allowed through. Config-dependent but a genuine logic inconsistency.\n\n## Suggested Fix\nCheck `FORBID_TAGS` before `tagCheck`:\n```\nif (FORBID_TAGS[tagName]) { /* remove */ }\nelse if (tagCheck(tagName) || ALLOWED_TAGS[tagName]) { /* keep */ }\n```\n\n## Affected Version\nv3.3.3 (commit 883ac15)","state":0,"publishedAt":"2026-04-16T00:46:35+00:00","modifiedAt":"2026-09-10T03:50:42.3794514+00:00","affected":[{"ecosystem":"npm","name":"dompurify","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.4.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-39q2-94rc-95cp","https://github.com/cure53/DOMPurify"],"sourceUrl":"https://github.com/advisories/GHSA-39q2-94rc-95cp","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-39q2-94rc-95cp","identifiers":["GHSA-39q2-94rc-95cp","CVE-2026-65903"]},"retained":false,"historicalAffected":[]}],"coverage":[]}