CVE-2026-65913CWE-1321

CVE-2026-65913

Medium · published July 23, 2026

CVSS v3.1

6.1

EPSS

Percentile

23.4

In the wild

Unconfirmed

What it is

DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.

The record

Technical detail

CVSS v3.1: 6.1 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00318 · 23.4th percentile
Weakness: CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published: 2026-07-23T18:18Z

Affected products (1)

Product	Versions	Fixed in
cure53/dompurify	< 3.3.2	3.3.2

References (2)

https://github.com/cure53/DOMPurify/security/advisories/GHSA-cj63-jhhr-wcxv · [email protected]https://www.vulncheck.com/advisories/dompurify-before-prototype-pollution-via-use-profiles · [email protected]

EPSS history

Timeline

23 JUL 13:16Z
DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES
cvelistv5