Catalogo CVE
CVE-2026-65913
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set
- Gravità
- Medium · CVSS 6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.32% · Oct 22, 2026
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | node-dompurify | sid | 3.4.16+dfsg-1 | fixed |
| Debian | node-dompurify | forky | 3.4.16+dfsg-1 | fixed |
| Debian | node-dompurify | trixie | 3.1.7+dfsg+~3.0.5-2 | vulnerable |
| Debian | node-dompurify | bookworm | 2.4.1+dfsg+~2.4.0-2+deb12u1 | vulnerable |
| Debian | node-dompurify | bookworm-security | 2.4.1+dfsg+~2.4.0-2 | vulnerable |
| Cpe | dompurify | Not reported | 3.3.2 | fixed |
| Ubuntu | node-dompurify | 22.04 | 2.3.0+dfsg-2 | vulnerable |
| Ubuntu | node-dompurify | 22.04 | 2.3.3+dfsg-1 | vulnerable |
| Ubuntu | node-dompurify | 24.04 | 2.4.1+dfsg+~2.4.0-1 | vulnerable |
| Ubuntu | node-dompurify | 24.04 | 3.0.9+dfsg+~3.0.5-1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | node-dompurify | source | sid | 3.3.2+dfsg-1 | not yet assigned | Not reported | Not reported |
| Debian | node-dompurify | source | forky | 3.3.2+dfsg-1 | not yet assigned | Not reported | Not reported |
| Debian | node-dompurify | source | trixie | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | node-dompurify | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
| Cpe | dompurify | cpe | Not reported | 3.3.2 | Not reported | NVD-CVE-2026-65913 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [node-dompurify]Interessata
Dettagli (4)
2.4.1+dfsg+~2.4.0-2+deb12u1· all · bookwormInteressata
nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12
2.4.1+dfsg+~2.4.0-2+deb12u1· all · bookwormInteressata
nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12
2.4.1+dfsg+~2.4.0-2· all · bookworm-securityInteressata
nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12
2.4.1+dfsg+~2.4.0-2· all · bookworm-securityInteressata
nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12
[Debian 13 (Trixie)]
- [node-dompurify]Interessata
Dettagli (2)
3.1.7+dfsg+~3.0.5-2· all · trixieInteressata
nvd · node-dompurify · debian · 13
3.1.7+dfsg+~3.0.5-2· all · trixieInteressata
nvd · node-dompurify · debian · 13
Osservato:
Riferimenti
- [https://access.redhat.com/errata/RHSA-2026:58500]
- [https://ftp.suse.com/pub/projects/security/]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-65913]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-65913]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-65913]
- [https://security-tracker.debian.org/tracker/CVE-2026-65913]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]