CVE-2026-65899
Medium
Description
DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Passing TRUSTED_TYPES_POLICY: null on the later call also does not clear the retained policy.
SeverityMedium
CVSS6.1
Exploit probability—
ProductCure53 Dompurify
PublishedJul 23, 2026
First seenJul 23, 2026
Weakness typeCWE-693CWE-693
How to fix
Update
- cure53 dompurify3.4.9 or later
- dompurify3.4.9 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cure53 dompurify | 3.0.0 ≤ v < 3.4.9 | 3.4.9 |
| dompurifynpm | v < 3.4.9 | 3.4.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.