CVE-2026-65903
Medium · 6.1CVSS
6.1
EPSS
0.3%
Published
Jul 23, 2026
CISA due date
—
The record
DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-101913 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in… CWE-697
- CVE-2026-101912 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in… CWE-697
- CVE-2026-90711 proxy-addr is a Node.js module that determines a request's client address behind trusted… CWE-697
- CVE-2026-64836 ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control… CWE-697
- CVE-2026-56101 OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the… CWE-697
- CVE-2026-73309 XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token… CWE-697
- CVE-2026-80227 Incorrect Comparison vulnerability in ash-project ash_sql allows a user to pad a string… CWE-697
- CVE-2026-18664 When ranges are used for access control (i.e. CWE-697