DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitize calls inherit the widened defaults and attacker payloads using the poisoned tag/attribute name survive sanitization. removeAllHooks(), clearConfig(), and passing a fresh cfg do not recover the state; only constructing a new DOMPurify instance does.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level
    DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute
    hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit
    cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array. A hook that mutates these fields permanently widens the default
    allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitize calls
    inherit the widened defaults and attacker payloads using the poisoned tag/attribute name survive
    sanitization. removeAllHooks(), clearConfig(), and passing a fresh cfg do not recover the state; only
    constructing a new DOMPurify instance does. (CVE-2026-65902)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level     DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute     hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit     cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array. A hook that mutates these fields permanently widens the default     allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitize calls     inherit the widened defaults and attacker payloads using the poisoned tag/attribute name survive     sanitization. removeAllHooks(), clearConfig(), and passing a fresh cfg do not recover the state; only     constructing a new DOMPurify instance does. (CVE-2026-65902)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
462742	Echo: dompurify: security update to 3.4.7	Tenable Cloud Security	Echo Local Security Checks	Local	medium
462742	Echo: dompurify: security update to 3.4.7	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
329712	Linux Distros Unpatched Vulnerability : CVE-2026-65902	Nessus	Misc.	Local	medium
443237	SCA: security update for dompurify (GHSA-76mc-f452-cxcm)	Tenable Cloud Security	SCA Checks	Local	medium
443237	SCA: security update for dompurify (GHSA-76mc-f452-cxcm)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-65902

medium

Tenable Plugins

medium

medium

medium

medium

medium