CVE-2026-65902 describes a vulnerability in DOMPurify versions prior to 3.4.7 where the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets are passed by reference to sanitization hooks if no explicit allowed tags or attributes are provided. A malicious hook can mutate these sets, permanently expanding the default allow-lists for the lifetime of the DOMPurify instance. Consequently, all future sanitizations using default settings will allow the poisoned tags or attributes, enabling attacker payloads to survive sanitization. Attempts to reset the state via removeAllHooks(), clearConfig(), or passing a fresh configuration do not restore the original defaults; only creating a new DOMPurify instance resets the allow-lists.

The vulnerability allows an attacker who can influence the sanitization hooks to permanently widen the default allowed tags and attributes, causing subsequent sanitizations to permit malicious content that should have been blocked. This undermines the sanitization guarantees of DOMPurify and can lead to cross-site scripting (XSS) or other injection attacks if exploited.

No official patch or fix is currently confirmed. Users should upgrade to DOMPurify version 3.4.7 or later once available to address this issue. Until then, to recover from a poisoned allow-list state, instantiate a new DOMPurify instance rather than relying on removeAllHooks(), clearConfig(), or passing fresh configurations. Monitor the vendor advisory for updates on remediation.