CVE-2026-65903CWE-697

CVE-2026-65903

Medium · published July 23, 2026

CVSS v3.1

6.1

EPSS

Percentile

24.4

In the wild

Unconfirmed

What it is

DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.

The record

Technical detail

CVSS v3.1: 6.1 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00325 · 24.4th percentile
Weakness: CWE-697 · Incorrect Comparison
Published: 2026-07-23T18:18Z

Affected products (1)

Product	Versions	Fixed in
cure53/dompurify	< 3.4.0	3.4.0

References (2)

https://github.com/cure53/DOMPurify/security/advisories/GHSA-39q2-94rc-95cp · [email protected]https://www.vulncheck.com/advisories/dompurify-before-add-tags-function-bypasses-forbid-tags · [email protected]

EPSS history

Timeline

23 JUL 13:16Z
DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS
cvelistv5