Skip to content

Commit e14485c

Browse files
eoftedalgithub-actions[bot]
eoftedal
and
github-actions[bot]
authored
Updated libraries (1): dompurify Updated vulnerability IDs (9): GHSA-39q2-94rc-95cp, GHSA-76mc-f452-cxcm, GHSA-cj63-jhhr-wcxv, GHSA-cjmm-f4jc-qw8r, GHSA-cmwh-pvxp-8882, GHSA-gvmj-g25r-r7wr, GHSA-h8r8-wccr-v5f2, GHSA-vxr8-fq34-vvx9, GHSA-x4vx-rjvf-j5p4 Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
1 parent 848fd4f commit e14485c

9 files changed

Lines changed: 324 additions & 81 deletions

‎repository/jsrepository-master.json‎

Lines changed: 36 additions & 9 deletions
Large diffs are not rendered by default.

‎repository/jsrepository-v2.json‎

Lines changed: 36 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5593,7 +5593,10 @@
55935593
],
55945594
"identifiers": {
55955595
"summary": "When USE_PROFILES is enabled, DOMPurify rebuilds ALLOWED_ATTR as a plain array whose properties are looked up by name, making it susceptible to prototype pollution. If Array.prototype has been polluted with an event handler attribute name (e.g. onclick), DOMPurify will allow that event handler to survive sanitization, resulting in DOM-based XSS.",
5596-
"githubID": "GHSA-cj63-jhhr-wcxv"
5596+
"githubID": "GHSA-cj63-jhhr-wcxv",
5597+
"CVE": [
5598+
"CVE-2026-65913"
5599+
]
55975600
},
55985601
"info": [
55995602
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cj63-jhhr-wcxv",
@@ -5609,7 +5612,10 @@
56095612
],
56105613
"identifiers": {
56115614
"summary": "DOMPurify's ADD_ATTR predicate function mechanism (via EXTRA_ELEMENT_HANDLING.attributeCheck) short-circuits URI validation when the predicate returns true. This allows unsafe protocols such as javascript: to survive sanitization in href and similar attributes, enabling DOM-based XSS when such links are activated.",
5612-
"githubID": "GHSA-cjmm-f4jc-qw8r"
5615+
"githubID": "GHSA-cjmm-f4jc-qw8r",
5616+
"CVE": [
5617+
"CVE-2026-65912"
5618+
]
56135619
},
56145620
"info": [
56155621
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cjmm-f4jc-qw8r",
@@ -5625,7 +5631,10 @@
56255631
],
56265632
"identifiers": {
56275633
"summary": "DOMPurify is vulnerable to mutation-XSS (mXSS) when sanitized HTML is embedded into special raw-text wrapper elements such as xmp, script, iframe, noembed, noframes, or noscript before being assigned via innerHTML. Attacker-controlled sequences like </xmp> inside attribute values close the raw-text context during the second parse, causing the sanitized output to mutate into executable markup.",
5628-
"githubID": "GHSA-h8r8-wccr-v5f2"
5634+
"githubID": "GHSA-h8r8-wccr-v5f2",
5635+
"CVE": [
5636+
"CVE-2026-65914"
5637+
]
56295638
},
56305639
"info": [
56315640
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-h8r8-wccr-v5f2",
@@ -5661,7 +5670,10 @@
56615670
],
56625671
"identifiers": {
56635672
"summary": "DOMPurify has a logic inconsistency where FORBID_TAGS is not checked when a function-based ADD_TAGS (tagCheck) returns true. Due to short-circuit evaluation, the FORBID_TAGS check is never evaluated, allowing explicitly forbidden elements to pass through sanitization when EXTRA_ELEMENT_HANDLING.tagCheck is configured.",
5664-
"githubID": "GHSA-39q2-94rc-95cp"
5673+
"githubID": "GHSA-39q2-94rc-95cp",
5674+
"CVE": [
5675+
"CVE-2026-65903"
5676+
]
56655677
},
56665678
"info": [
56675679
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-39q2-94rc-95cp"
@@ -5795,7 +5807,10 @@
57955807
],
57965808
"identifiers": {
57975809
"summary": "DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`",
5798-
"githubID": "GHSA-76mc-f452-cxcm"
5810+
"githubID": "GHSA-76mc-f452-cxcm",
5811+
"CVE": [
5812+
"CVE-2026-65902"
5813+
]
57995814
},
58005815
"info": [
58015816
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-76mc-f452-cxcm"
@@ -5828,7 +5843,10 @@
58285843
],
58295844
"identifiers": {
58305845
"summary": "DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects",
5831-
"githubID": "GHSA-x4vx-rjvf-j5p4"
5846+
"githubID": "GHSA-x4vx-rjvf-j5p4",
5847+
"CVE": [
5848+
"CVE-2026-65901"
5849+
]
58325850
},
58335851
"info": [
58345852
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4"
@@ -5843,7 +5861,10 @@
58435861
],
58445862
"identifiers": {
58455863
"summary": "DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes",
5846-
"githubID": "GHSA-gvmj-g25r-r7wr"
5864+
"githubID": "GHSA-gvmj-g25r-r7wr",
5865+
"CVE": [
5866+
"CVE-2026-65900"
5867+
]
58475868
},
58485869
"info": [
58495870
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-gvmj-g25r-r7wr"
@@ -5858,7 +5879,10 @@
58585879
],
58595880
"identifiers": {
58605881
"summary": "DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output",
5861-
"githubID": "GHSA-vxr8-fq34-vvx9"
5882+
"githubID": "GHSA-vxr8-fq34-vvx9",
5883+
"CVE": [
5884+
"CVE-2026-65899"
5885+
]
58625886
},
58635887
"info": [
58645888
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-vxr8-fq34-vvx9"
@@ -5875,7 +5899,10 @@
58755899
],
58765900
"identifiers": {
58775901
"summary": "DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)",
5878-
"githubID": "GHSA-cmwh-pvxp-8882"
5902+
"githubID": "GHSA-cmwh-pvxp-8882",
5903+
"CVE": [
5904+
"CVE-2026-65898"
5905+
]
58795906
},
58805907
"info": [
58815908
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882"

‎repository/jsrepository-v3.json‎

Lines changed: 36 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5690,7 +5690,10 @@
56905690
],
56915691
"identifiers": {
56925692
"summary": "When USE_PROFILES is enabled, DOMPurify rebuilds ALLOWED_ATTR as a plain array whose properties are looked up by name, making it susceptible to prototype pollution. If Array.prototype has been polluted with an event handler attribute name (e.g. onclick), DOMPurify will allow that event handler to survive sanitization, resulting in DOM-based XSS.",
5693-
"githubID": "GHSA-cj63-jhhr-wcxv"
5693+
"githubID": "GHSA-cj63-jhhr-wcxv",
5694+
"CVE": [
5695+
"CVE-2026-65913"
5696+
]
56945697
},
56955698
"info": [
56965699
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cj63-jhhr-wcxv",
@@ -5706,7 +5709,10 @@
57065709
],
57075710
"identifiers": {
57085711
"summary": "DOMPurify's ADD_ATTR predicate function mechanism (via EXTRA_ELEMENT_HANDLING.attributeCheck) short-circuits URI validation when the predicate returns true. This allows unsafe protocols such as javascript: to survive sanitization in href and similar attributes, enabling DOM-based XSS when such links are activated.",
5709-
"githubID": "GHSA-cjmm-f4jc-qw8r"
5712+
"githubID": "GHSA-cjmm-f4jc-qw8r",
5713+
"CVE": [
5714+
"CVE-2026-65912"
5715+
]
57105716
},
57115717
"info": [
57125718
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cjmm-f4jc-qw8r",
@@ -5722,7 +5728,10 @@
57225728
],
57235729
"identifiers": {
57245730
"summary": "DOMPurify is vulnerable to mutation-XSS (mXSS) when sanitized HTML is embedded into special raw-text wrapper elements such as xmp, script, iframe, noembed, noframes, or noscript before being assigned via innerHTML. Attacker-controlled sequences like </xmp> inside attribute values close the raw-text context during the second parse, causing the sanitized output to mutate into executable markup.",
5725-
"githubID": "GHSA-h8r8-wccr-v5f2"
5731+
"githubID": "GHSA-h8r8-wccr-v5f2",
5732+
"CVE": [
5733+
"CVE-2026-65914"
5734+
]
57265735
},
57275736
"info": [
57285737
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-h8r8-wccr-v5f2",
@@ -5758,7 +5767,10 @@
57585767
],
57595768
"identifiers": {
57605769
"summary": "DOMPurify has a logic inconsistency where FORBID_TAGS is not checked when a function-based ADD_TAGS (tagCheck) returns true. Due to short-circuit evaluation, the FORBID_TAGS check is never evaluated, allowing explicitly forbidden elements to pass through sanitization when EXTRA_ELEMENT_HANDLING.tagCheck is configured.",
5761-
"githubID": "GHSA-39q2-94rc-95cp"
5770+
"githubID": "GHSA-39q2-94rc-95cp",
5771+
"CVE": [
5772+
"CVE-2026-65903"
5773+
]
57625774
},
57635775
"info": [
57645776
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-39q2-94rc-95cp"
@@ -5892,7 +5904,10 @@
58925904
],
58935905
"identifiers": {
58945906
"summary": "DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`",
5895-
"githubID": "GHSA-76mc-f452-cxcm"
5907+
"githubID": "GHSA-76mc-f452-cxcm",
5908+
"CVE": [
5909+
"CVE-2026-65902"
5910+
]
58965911
},
58975912
"info": [
58985913
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-76mc-f452-cxcm"
@@ -5925,7 +5940,10 @@
59255940
],
59265941
"identifiers": {
59275942
"summary": "DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects",
5928-
"githubID": "GHSA-x4vx-rjvf-j5p4"
5943+
"githubID": "GHSA-x4vx-rjvf-j5p4",
5944+
"CVE": [
5945+
"CVE-2026-65901"
5946+
]
59295947
},
59305948
"info": [
59315949
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4"
@@ -5940,7 +5958,10 @@
59405958
],
59415959
"identifiers": {
59425960
"summary": "DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes",
5943-
"githubID": "GHSA-gvmj-g25r-r7wr"
5961+
"githubID": "GHSA-gvmj-g25r-r7wr",
5962+
"CVE": [
5963+
"CVE-2026-65900"
5964+
]
59445965
},
59455966
"info": [
59465967
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-gvmj-g25r-r7wr"
@@ -5955,7 +5976,10 @@
59555976
],
59565977
"identifiers": {
59575978
"summary": "DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output",
5958-
"githubID": "GHSA-vxr8-fq34-vvx9"
5979+
"githubID": "GHSA-vxr8-fq34-vvx9",
5980+
"CVE": [
5981+
"CVE-2026-65899"
5982+
]
59595983
},
59605984
"info": [
59615985
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-vxr8-fq34-vvx9"
@@ -5972,7 +5996,10 @@
59725996
],
59735997
"identifiers": {
59745998
"summary": "DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)",
5975-
"githubID": "GHSA-cmwh-pvxp-8882"
5999+
"githubID": "GHSA-cmwh-pvxp-8882",
6000+
"CVE": [
6001+
"CVE-2026-65898"
6002+
]
59766003
},
59776004
"info": [
59786005
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882"

‎repository/jsrepository-v4.json‎

Lines changed: 36 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5689,7 +5689,10 @@
56895689
],
56905690
"identifiers": {
56915691
"summary": "When USE_PROFILES is enabled, DOMPurify rebuilds ALLOWED_ATTR as a plain array whose properties are looked up by name, making it susceptible to prototype pollution. If Array.prototype has been polluted with an event handler attribute name (e.g. onclick), DOMPurify will allow that event handler to survive sanitization, resulting in DOM-based XSS.",
5692-
"githubID": "GHSA-cj63-jhhr-wcxv"
5692+
"githubID": "GHSA-cj63-jhhr-wcxv",
5693+
"CVE": [
5694+
"CVE-2026-65913"
5695+
]
56935696
},
56945697
"info": [
56955698
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cj63-jhhr-wcxv",
@@ -5705,7 +5708,10 @@
57055708
],
57065709
"identifiers": {
57075710
"summary": "DOMPurify's ADD_ATTR predicate function mechanism (via EXTRA_ELEMENT_HANDLING.attributeCheck) short-circuits URI validation when the predicate returns true. This allows unsafe protocols such as javascript: to survive sanitization in href and similar attributes, enabling DOM-based XSS when such links are activated.",
5708-
"githubID": "GHSA-cjmm-f4jc-qw8r"
5711+
"githubID": "GHSA-cjmm-f4jc-qw8r",
5712+
"CVE": [
5713+
"CVE-2026-65912"
5714+
]
57095715
},
57105716
"info": [
57115717
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cjmm-f4jc-qw8r",
@@ -5721,7 +5727,10 @@
57215727
],
57225728
"identifiers": {
57235729
"summary": "DOMPurify is vulnerable to mutation-XSS (mXSS) when sanitized HTML is embedded into special raw-text wrapper elements such as xmp, script, iframe, noembed, noframes, or noscript before being assigned via innerHTML. Attacker-controlled sequences like </xmp> inside attribute values close the raw-text context during the second parse, causing the sanitized output to mutate into executable markup.",
5724-
"githubID": "GHSA-h8r8-wccr-v5f2"
5730+
"githubID": "GHSA-h8r8-wccr-v5f2",
5731+
"CVE": [
5732+
"CVE-2026-65914"
5733+
]
57255734
},
57265735
"info": [
57275736
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-h8r8-wccr-v5f2",
@@ -5757,7 +5766,10 @@
57575766
],
57585767
"identifiers": {
57595768
"summary": "DOMPurify has a logic inconsistency where FORBID_TAGS is not checked when a function-based ADD_TAGS (tagCheck) returns true. Due to short-circuit evaluation, the FORBID_TAGS check is never evaluated, allowing explicitly forbidden elements to pass through sanitization when EXTRA_ELEMENT_HANDLING.tagCheck is configured.",
5760-
"githubID": "GHSA-39q2-94rc-95cp"
5769+
"githubID": "GHSA-39q2-94rc-95cp",
5770+
"CVE": [
5771+
"CVE-2026-65903"
5772+
]
57615773
},
57625774
"info": [
57635775
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-39q2-94rc-95cp"
@@ -5891,7 +5903,10 @@
58915903
],
58925904
"identifiers": {
58935905
"summary": "DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`",
5894-
"githubID": "GHSA-76mc-f452-cxcm"
5906+
"githubID": "GHSA-76mc-f452-cxcm",
5907+
"CVE": [
5908+
"CVE-2026-65902"
5909+
]
58955910
},
58965911
"info": [
58975912
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-76mc-f452-cxcm"
@@ -5924,7 +5939,10 @@
59245939
],
59255940
"identifiers": {
59265941
"summary": "DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects",
5927-
"githubID": "GHSA-x4vx-rjvf-j5p4"
5942+
"githubID": "GHSA-x4vx-rjvf-j5p4",
5943+
"CVE": [
5944+
"CVE-2026-65901"
5945+
]
59285946
},
59295947
"info": [
59305948
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4"
@@ -5939,7 +5957,10 @@
59395957
],
59405958
"identifiers": {
59415959
"summary": "DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes",
5942-
"githubID": "GHSA-gvmj-g25r-r7wr"
5960+
"githubID": "GHSA-gvmj-g25r-r7wr",
5961+
"CVE": [
5962+
"CVE-2026-65900"
5963+
]
59435964
},
59445965
"info": [
59455966
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-gvmj-g25r-r7wr"
@@ -5954,7 +5975,10 @@
59545975
],
59555976
"identifiers": {
59565977
"summary": "DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output",
5957-
"githubID": "GHSA-vxr8-fq34-vvx9"
5978+
"githubID": "GHSA-vxr8-fq34-vvx9",
5979+
"CVE": [
5980+
"CVE-2026-65899"
5981+
]
59585982
},
59595983
"info": [
59605984
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-vxr8-fq34-vvx9"
@@ -5971,7 +5995,10 @@
59715995
],
59725996
"identifiers": {
59735997
"summary": "DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)",
5974-
"githubID": "GHSA-cmwh-pvxp-8882"
5998+
"githubID": "GHSA-cmwh-pvxp-8882",
5999+
"CVE": [
6000+
"CVE-2026-65898"
6001+
]
59756002
},
59766003
"info": [
59776004
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882"

0 commit comments

Comments
 (0)