DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe protocols like javascript: to survive sanitization and execute as DOM-based XSS when the link is activated.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a
    predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that
    accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe protocols
    like javascript: to survive sanitization and execute as DOM-based XSS when the link is activated.
    (CVE-2026-65912)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a     predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that     accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe protocols     like javascript: to survive sanitization and execute as DOM-based XSS when the link is activated.
    (CVE-2026-65912)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
465293	Echo: dompurify: security update to 3.3.2	Tenable Cloud Security	Echo Local Security Checks	Local	medium
465293	Echo: dompurify: security update to 3.3.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
329685	Linux Distros Unpatched Vulnerability : CVE-2026-65912	Nessus	Misc.	Local	medium
439739	SCA: security update for dompurify (GHSA-cjmm-f4jc-qw8r)	Tenable Cloud Security	SCA Checks	Local	medium
439739	SCA: security update for dompurify (GHSA-cjmm-f4jc-qw8r)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-65912

medium

Tenable Plugins

medium

medium

medium

medium

medium