CVE-2026-65912: 
JavaScript vulnerability analysis and mitigation

CVE-2026-65912 is a URI validation bypass vulnerability in DOMPurify, a widely-used HTML sanitization library maintained by cure53, that enables DOM-based Cross-Site Scripting (XSS). The flaw exists in versions prior to 3.3.2 and was disclosed on July 23, 2026, with the original security advisory published by cure53 on April 1, 2026. It affects all DOMPurify releases up to and including 3.3.1 when the EXTRA_ELEMENT_HANDLING.attributeCheck feature is used with a predicate function. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) (Feedly, GitHub Advisory).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). DOMPurify supports a configuration option EXTRA_ELEMENT_HANDLING.attributeCheck that allows callers to supply a predicate function as the ADD_ATTR handler. When this predicate returns true for a given attribute/tag combination, the internal _isValidAttribute function short-circuits and skips URI-safe validation entirely. An attacker who can influence the predicate's behavior — or who operates in an application that uses a permissive predicate accepting href on anchor (<a>) tags — can craft input containing a javascript: URL that survives sanitization. A proof-of-concept was included in the advisory, demonstrating that a sanitized payload with a javascript: href executes when the link is activated inside an iframe (GitHub Advisory, Feedly).

Successful exploitation results in DOM-based XSS execution in the victim's browser when an injected link is activated, impacting both confidentiality and integrity within the browser's security context. An attacker can steal session cookies, perform actions on behalf of the user, redirect to phishing pages, or inject malicious scripts into the page. The scope is marked as "Changed" in CVSS v3.1, indicating that the impact extends beyond the vulnerable component itself to the user's browser environment. Availability is not directly impacted, but the integrity and confidentiality of user sessions and data are at risk (Feedly, GitHub Advisory).

1. Identify a vulnerable application: Find a web application using DOMPurify ≤ 3.3.1 that also configures EXTRA_ELEMENT_HANDLING.attributeCheck with a predicate function that returns true for href attributes on <a> (anchor) elements.
2. Craft a malicious payload: Construct an HTML snippet containing an anchor tag with a javascript: URI, e.g., <a href="javascript:alert(document.cookie)">Click me</a>.
3. Submit the payload for sanitization: Inject the crafted HTML into the application's input field or parameter that is processed by the vulnerable DOMPurify configuration. Because the predicate returns true for href on <a>, _isValidAttribute short-circuits and skips URI validation, allowing the javascript: URL to survive sanitization.
4. Deliver to victim: Ensure the sanitized (but still malicious) output is rendered in the victim's browser — for example, via a stored XSS vector (saved content) or a reflected vector (shared link).
5. Trigger execution: Induce the victim to click the malicious link. The javascript: protocol executes in the browser context, achieving DOM-based XSS — enabling session hijacking, credential theft, or further exploitation (GitHub Advisory).

• Network: Outbound requests from a victim's browser to unexpected third-party domains shortly after interacting with user-generated content; unusual document.cookie or credential data appearing in HTTP request parameters or headers to attacker-controlled endpoints.
• Logs: Web server or application logs showing injection of javascript: URI strings in input fields or URL parameters; repeated submissions of anchor tags with href values containing javascript: to endpoints that process HTML.
• Browser/Client-Side: Unexpected JavaScript execution triggered by clicking links within user-generated content areas; browser console errors related to blocked javascript: navigation (in environments with stricter CSP) that may indicate attempted exploitation.
• Application: Presence of javascript: strings in stored content (database records, CMS entries) that passed through DOMPurify sanitization, indicating the bypass was used (GitHub Advisory).

Upgrade DOMPurify to version 3.3.2 or later, which patches the URI validation bypass by ensuring that _isValidAttribute does not short-circuit URI-safe validation when a predicate function is used (GitHub Advisory). As a workaround for applications that cannot immediately upgrade, avoid using EXTRA_ELEMENT_HANDLING.attributeCheck with predicates that return true for URL-bearing attributes such as href, src, or action on elements like <a>, <iframe>, or <form>. Additionally, implementing a strict Content Security Policy (CSP) that disallows javascript: URIs and inline script execution can reduce the exploitability of this vulnerability as a defense-in-depth measure.

The vulnerability was discovered and reported by Cantina's Apex security team (https://www.cantina.security), and cure53 credited the researcher christos-eth in the GitHub Security Advisory (GitHub Advisory). The advisory was rated "Moderate" severity by cure53. Tenable has published a cloud security plugin (ID 439739) covering this vulnerability, indicating uptake in vulnerability management tooling (Feedly). No significant broader social media or media coverage has been identified at this time.