{"action":"Upgrade dompurify to 3.4.12 or later.","affected":[{"fixed":"3.4.12","introduced":"0"}],"component":"dompurify","cve_ids":["CVE-2026-66010"],"ecosystem":"npm","epss":0.00215,"exploited":false,"fixed_versions":["3.4.12"],"ghsa_id":"GHSA-c2j3-45gr-mqc4","id":"tcs_01M5KFHFQ7M184DN4QQNG90S3Q","modified_at":"2026-10-02T23:00:15.983015754Z","published_at":"2026-07-21T19:41:07Z","references":["https://osv.dev/vulnerability/GHSA-c2j3-45gr-mqc4","https://github.com/cure53/DOMPurify/security/advisories/GHSA-c2j3-45gr-mqc4","https://nvd.nist.gov/vuln/detail/CVE-2026-66010","https://github.com/cure53/DOMPurify/pull/1537","https://github.com/cure53/DOMPurify/commit/a9ca1e537422319a557a9a2aa61f003b23b4a197","https://github.com/cure53/DOMPurify","https://github.com/cure53/DOMPurify/releases/tag/3.4.12","https://www.vulncheck.com/advisories/dompurify-before-hook-bypass-via-custom-element-handling"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-c2j3-45gr-mqc4","url":"https://osv.dev/vulnerability/GHSA-c2j3-45gr-mqc4"}],"summary":"DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements."}