CVE-2026-65902 describes a vulnerability in DOMPurify versions prior to 3.4.7 (<=3.4.5) where the module-level default allowed tags and attributes sets are passed by reference to sanitization hooks when sanitize is called without explicit allowed tags or attributes configuration. If a hook mutates these sets, it permanently widens the default allow-lists for that DOMPurify instance, causing subsequent sanitizations using default configurations to inherit the widened allow-lists. This allows attacker payloads using the poisoned tag or attribute names to survive sanitization. Attempts to recover the original state via removeAllHooks(), clearConfig(), or passing a fresh configuration do not work; only constructing a new DOMPurify instance resets the defaults.

The vulnerability allows an attacker to bypass DOMPurify's sanitization by poisoning the default allowed tags or attributes lists via hooks, resulting in malicious tags or attributes surviving sanitization in all subsequent calls using default configurations on the same DOMPurify instance. This could lead to persistent cross-site scripting (XSS) or other injection attacks if the poisoned instance is reused. The impact is limited to applications using affected DOMPurify versions and relying on default sanitization configurations without recreating the DOMPurify instance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, the recommended mitigation is to avoid reusing the same DOMPurify instance after hooks that mutate allowed tags or attributes have been used. Constructing a new DOMPurify instance resets the allow-lists to their original state. Additionally, avoid using sanitize calls without explicit allowed tags or attributes configuration if hooks are involved.