CVE-2026-65913: 
JavaScript vulnerability analysis and mitigation

CVE-2026-65913 is a prototype pollution vulnerability in DOMPurify (by cure53) that enables DOM-based Cross-Site Scripting (XSS) when the library is used in USE_PROFILES mode. All versions of DOMPurify prior to 3.3.2 are affected. The vulnerability was identified by Cantina's Apex security team and the GitHub Security Advisory (GHSA-cj63-jhhr-wcxv) was published on April 1, 2026; the CVE was assigned and published on July 23, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes — Prototype Pollution). When USE_PROFILES is enabled, DOMPurify rebuilds its ALLOWED_ATTR list as a plain JavaScript array before populating it with the requested allowlists. Because attribute lookups are performed via ALLOWED_ATTR[lcName], any property set on Array.prototype is also treated as an allowlisted attribute. An attacker who can pollute Array.prototype — for example, by setting Array.prototype.onclick = true — causes DOMPurify to treat event handler attributes like onclick as allowlisted, allowing them to survive sanitization. This results in DOM-based XSS when the sanitized markup is subsequently rendered in the browser. Exploitation requires user interaction (the victim must trigger the event handler) and the application must be using DOMPurify in USE_PROFILES mode in an environment already subject to, or exploitable for, prototype pollution (GitHub Advisory).

Successful exploitation results in DOM-based XSS, allowing an attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim, and potential account takeover. The confidentiality and integrity of user data are both at risk, though availability is not directly impacted. The scope is changed (browser context), meaning the impact extends beyond the vulnerable component itself (GitHub Advisory, Feedly).

1. Identify a target application: Find a web application that uses DOMPurify < 3.3.2 with the USE_PROFILES option enabled and renders the sanitized output into the DOM.
2. Achieve prototype pollution: Exploit a separate prototype pollution vulnerability in the application (e.g., via a vulnerable dependency or user-controlled JSON merge) to set Array.prototype.onclick = true (or another event handler property) in the JavaScript runtime.
3. Craft malicious input: Prepare an HTML payload containing an event handler attribute, such as <img src=x onclick=alert(document.cookie)>.
4. Submit the payload: Deliver the crafted HTML to the application through any input vector that is processed by DOMPurify (e.g., a comment field, rich text editor, or URL parameter).
5. Bypass sanitization: Because Array.prototype.onclick is true, DOMPurify's attribute lookup treats onclick as allowlisted and does not strip it from the output.
6. Trigger XSS: When the victim's browser renders the sanitized (but still malicious) markup and the user interacts with the element (e.g., clicks the image), the event handler executes arbitrary JavaScript in the victim's session (GitHub Advisory).

• Logs: Web server or application logs showing unusual or encoded HTML payloads containing event handler attributes (e.g., onclick, onmouseover) in user-submitted input fields.
• Network: Outbound requests from victim browsers to attacker-controlled domains (e.g., for cookie exfiltration) originating from pages that render user-supplied content.
• Browser/Client-Side: Browser console errors or unexpected JavaScript execution on pages that use DOMPurify-sanitized content; CSP violation reports triggered by inline event handlers.
• Application: Evidence of prototype pollution in JavaScript runtime logs or error tracking (e.g., unexpected properties on Array.prototype detected by runtime integrity checks).

Upgrade DOMPurify to version 3.3.2 or later, which patches the prototype pollution issue in USE_PROFILES mode. As a defense-in-depth measure, deploy a strict Content Security Policy (CSP) that disallows inline event handlers (unsafe-inline), which would mitigate the XSS impact even if prototype pollution occurs. Additionally, audit all dependencies for prototype pollution vulnerabilities, as this attack requires a polluted Array.prototype as a precondition. There is no documented configuration-only workaround short of disabling USE_PROFILES mode (GitHub Advisory).

The vulnerability was identified by Cantina's Apex security team and responsibly disclosed to the cure53/DOMPurify maintainers, who published the GitHub Security Advisory (GHSA-cj63-jhhr-wcxv) on April 1, 2026. The advisory was rated "Moderate" severity by the maintainers. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified at this time (GitHub Advisory).