CVE-2026-65913 describes a prototype pollution vulnerability in DOMPurify before version 3.3.2 when operating in USE_PROFILES mode. Attackers can manipulate Array.prototype properties, for example setting 'onclick' to true, which causes DOMPurify to incorrectly allow event handler attributes. This bypass of attribute filtering can lead to DOM-based XSS vulnerabilities when the sanitized content is rendered in a browser environment. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. No official patch or remediation level has been stated in the available data.

The vulnerability enables attackers to bypass DOMPurify's attribute filtering by polluting prototype properties, potentially allowing malicious event handlers to be accepted. This can lead to DOM-based cross-site scripting attacks when the sanitized markup is rendered, posing a risk to client-side security and user data integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using DOMPurify in USE_PROFILES mode or apply additional filtering controls to prevent prototype pollution. Monitor vendor channels for updates regarding patches or official mitigations.