{"action":"Upgrade dompurify to 3.4.11 or later.","affected":[{"fixed":"3.4.11","introduced":"0"}],"component":"dompurify","cve_ids":["CVE-2026-65898"],"ecosystem":"npm","epss":0.00212,"exploited":false,"fixed_versions":["3.4.11"],"ghsa_id":"GHSA-cmwh-pvxp-8882","id":"tcs_01M5KFK5N6E3CV4EXCX53RBVHQ","modified_at":"2026-09-10T03:51:08.631772464Z","published_at":"2026-06-18T14:27:37Z","references":["https://osv.dev/vulnerability/GHSA-cmwh-pvxp-8882","https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882","https://github.com/cure53/DOMPurify/pull/1482","https://github.com/cure53/DOMPurify/commit/011bc3b2fcc4be17aa76f9030e8668207717acb9","https://github.com/cure53/DOMPurify","https://github.com/cure53/DOMPurify/releases/tag/3.4.11"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-cmwh-pvxp-8882","url":"https://osv.dev/vulnerability/GHSA-cmwh-pvxp-8882"}],"summary":"DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)"}