Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
cure53 DOMPurify — DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV
N L N N A N N N 5.1 .0019 9.1 —
AFFECTED
Product Versions Fixed
DOMPurify unspecified 3.4.0
TIMELINE
Jul 23 EXPLOIT PUBLISHED — CVE-2026-65911 (cure53 DOMPurify). Public exploit reference added.
Jul 23 Reserved by VulnCheck
Jul 23 Published (CNA: VulnCheck)
Jul 28 EXPLOIT PUBLISHED — CVE-2026-65911 (cure53 DOMPurify). Public exploit reference added.
Description
In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can allow dangerous event-handler attributes or forbidden tags (bypassing FORBID_TAGS) to survive sanitization, resulting in cross-site scripting. The vendor (Cure53) considers this an edge case outside DOMPurify's threat model; the referenced advisory lists 3.4.0 as the patched version.
Lifecycle
Complete event history — 4 events, chronological
| Date | Event | Detail |
|---|
| July 23, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-65911 (cure53 DOMPurify). Public exploit reference added. |
| July 23, 2026 | Reserved | Reserved by VulnCheck |
| July 23, 2026 | Published | Published (CNA: VulnCheck) |
| July 28, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-65911 (cure53 DOMPurify). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| cure53 | DOMPurify | — | — | 3.4.0 |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-65911 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.