CVE-2026-65912 describes a cross-site scripting vulnerability in DOMPurify prior to version 3.3.2. The issue arises when the ADD_ATTR attribute is provided as a predicate function through EXTRA_ELEMENT_HANDLING.attributeCheck, allowing attackers to craft predicates that accept specific attribute and tag combinations. This bypasses the URI-safe validation mechanism, enabling unsafe protocols such as javascript: to survive sanitization and execute as DOM-based XSS upon link activation. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. No vendor advisory or patch information is currently available.

An attacker can bypass DOMPurify's URI validation by supplying a crafted predicate function, allowing unsafe protocols like javascript: to persist in sanitized content. This can lead to DOM-based cross-site scripting attacks when a user activates a malicious link, potentially resulting in script execution within the victim's browser context. The vulnerability affects the security of web applications relying on DOMPurify for sanitization of user-supplied content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted predicate functions with EXTRA_ELEMENT_HANDLING.attributeCheck in DOMPurify. Consider restricting or reviewing custom attribute checks to prevent unsafe URI protocols from bypassing sanitization.