Description

DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.

Remediation

References

CVE-2026-65903

Related Vulnerabilities

MongoDb Improper Encoding or Escaping of Output Vulnerability (CVE-2021-20333)

OpenSSL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-2178)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-12766)

PostgreSQL Improper Validation of Array Index Vulnerability (CVE-2026-2006)

Drupal Core 9.1.x Cross-Site Request Forgery (9.1.0 - 9.1.12)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-697 CVE-2026-65903