CVE-2026-65913

Katalog CVE

CVSS 6.1 · Medium EPSS 0,32%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada cure53 dompurify. Skor CVSS 3.1 6.1 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.

Rincian

Terbit di NVD

23 Juli 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 22,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-cj63-jhhr-wcxv advisory pihak ketiga
• https://www.vulncheck.com/advisories/dompurify-before-prototype-pollution-via-use-profiles advisory pihak ketiga