{"id":"GHSA-cjmm-f4jc-qw8r","revision":"9571010f70d34543bee26caf24fdfba0","records":[{"revision":"9571010f70d34543bee26caf24fdfba0","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-cjmm-f4jc-qw8r","aliases":["CVE-2026-65912"],"title":"DOMPurify ADD_ATTR predicate skips URI validation","description":"## Summary\nDOMPurify allows `ADD_ATTR` to be provided as a predicate function via `EXTRA_ELEMENT_HANDLING.attributeCheck`. When the predicate returns `true`, `_isValidAttribute` short-circuits the attribute check before URI-safe validation runs. An attacker who supplies a predicate that accepts specific attribute/tag combinations can then sanitize input such as `<a href=\"javascript:alert(document.domain)\">` and have the `javascript:` URL survive, because URI validation is skipped for that attribute while other checks still pass. The provided PoC accepts `href` for anchors and then triggers a click inside an iframe, showing that the sanitized payload executes despite the protocol bypass.\n\n## Impact\nPredicate-based allowlisting bypasses DOMPurify's URI validation, allowing unsafe protocols such as `javascript:` to reach the DOM and execute whenever the link is activated, resulting in DOM-based XSS.\n\n## Credits\nIdentified by Cantina’s Apex (https://www.cantina.security).","state":0,"publishedAt":"2026-04-03T03:46:07+00:00","modifiedAt":"2026-09-10T03:50:43.8915274+00:00","affected":[{"ecosystem":"npm","name":"dompurify","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.3.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-cjmm-f4jc-qw8r","https://github.com/cure53/DOMPurify","https://github.com/cure53/DOMPurify/releases/tag/3.3.2"],"sourceUrl":"https://github.com/advisories/GHSA-cjmm-f4jc-qw8r","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-cjmm-f4jc-qw8r","identifiers":["GHSA-cjmm-f4jc-qw8r","CVE-2026-65912"]},"retained":false,"historicalAffected":[]}],"coverage":[]}