{"id":"GHSA-cj63-jhhr-wcxv","revision":"acb3323a0ac94ddb96ff283d910ff0ce","records":[{"revision":"acb3323a0ac94ddb96ff283d910ff0ce","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-cj63-jhhr-wcxv","aliases":["CVE-2026-65913"],"title":"DOMPurify USE_PROFILES prototype pollution allows event handlers","description":"## Summary\nWhen `USE_PROFILES` is enabled, DOMPurify rebuilds `ALLOWED_ATTR` as a plain array before populating it with the requested allowlists. Because the sanitizer still looks up attributes via `ALLOWED_ATTR[lcName]`, any `Array.prototype` property that is polluted also counts as an allowlisted attribute. An attacker who can set `Array.prototype.onclick = true` (or a runtime already subject to prototype pollution) can thus force DOMPurify to keep event handlers such as `onclick` even when they are normally forbidden. The provided PoC sanitizes `<img onclick=...>` with `USE_PROFILES` and adds the sanitized output to the DOM; the polluted prototype allows the event handler to survive and execute, turning what should be a blocklist into a silent XSS vector.\n\n## Impact\nPrototype pollution makes DOMPurify accept dangerous event handler attributes, which bypasses the sanitizer and results in DOM-based XSS once the sanitized markup is rendered.\n\n## Credits\nIdentified by Cantina’s Apex (https://www.cantina.security).","state":0,"publishedAt":"2026-04-03T03:45:08+00:00","modifiedAt":"2026-09-10T03:50:43.8327235+00:00","affected":[{"ecosystem":"npm","name":"dompurify","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.3.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-cj63-jhhr-wcxv","https://github.com/cure53/DOMPurify","https://github.com/cure53/DOMPurify/releases/tag/3.3.2"],"sourceUrl":"https://github.com/advisories/GHSA-cj63-jhhr-wcxv","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-cj63-jhhr-wcxv","identifiers":["GHSA-cj63-jhhr-wcxv","CVE-2026-65913"]},"retained":false,"historicalAffected":[]}],"coverage":[]}