Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2026-65898 - Vulnerability Database
DOMPurify

DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2026-65898

High
Reference: CVE-2026-65898
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-65898
Title: DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Overview:

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.