CVE-2026-65903 — DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS
DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can cra…
Published: 2026-07-23 · CVSS: 5.1 · CVSS 4.0
DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7