CVE-2026-66010 Overview
CVE-2026-66010 affects DOMPurify versions prior to 3.4.12. The library fails to execute the afterSanitizeElements hook for custom elements permitted through CUSTOM_ELEMENT_HANDLING.tagNameCheck. This gap allows attributes to bypass application security policies that rely on hook-based filtering.
Attackers can preserve sensitive attributes on custom elements. When downstream code re-injects those elements into innerHTML sinks, the preserved attributes execute as second-order cross-site scripting (XSS) gadgets [CWE-79]. The flaw undermines defense-in-depth strategies where developers depend on afterSanitizeElements to strip dangerous attributes after tag-level validation.
Critical Impact
Applications using DOMPurify with custom element allowlists lose a critical sanitization layer, enabling stored or reflected XSS through attribute-carrying custom elements.
Affected Products
- DOMPurify versions before 3.4.12
- Web applications embedding DOMPurify with CUSTOM_ELEMENT_HANDLING.tagNameCheck configured
- Downstream libraries and frameworks bundling vulnerable DOMPurify releases
Discovery Timeline
- 2026-07-24 - CVE-2026-66010 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-66010
Vulnerability Analysis
DOMPurify sanitizes untrusted HTML by walking the parsed DOM and invoking registered hooks at defined stages. The afterSanitizeElements hook fires after each element is processed and lets developers apply custom attribute filtering or element rewriting. When CUSTOM_ELEMENT_HANDLING.tagNameCheck is configured to allow specific custom elements, DOMPurify permits those tags through the sanitization pipeline.
The defect prevents afterSanitizeElements from firing for these allowlisted custom elements. Attribute-level policies that developers layer on top of tag allowlisting never execute. Attributes that should be stripped, such as onclick, onerror, or framework-specific event bindings, remain intact on the sanitized output.
The risk materializes when sanitized markup is later assigned to innerHTML or a similar sink. The browser parses the preserved attributes and executes their handlers, producing an XSS gadget that bypasses the application's sanitization contract.
Root Cause
The root cause is a control-flow gap in DOMPurify's element processing pipeline. Custom elements accepted through tagNameCheck skip the code path that dispatches afterSanitizeElements. Hook-based attribute enforcement therefore silently fails while returning apparently sanitized output.
Attack Vector
Exploitation requires user interaction, such as loading attacker-controlled content in an application that sanitizes with DOMPurify. An attacker crafts markup containing an allowlisted custom element carrying malicious attributes. The sanitizer returns the element unchanged because the afterSanitizeElements hook never runs. When the application inserts the result into the DOM through an innerHTML sink, the browser activates the attributes and executes attacker-supplied script.
The vulnerability is described in prose only. See the GitHub Security Advisory and the VulnCheck Advisory for technical details.
Detection Methods for CVE-2026-66010
Indicators of Compromise
- Sanitized HTML output containing custom elements with unexpected event-handler attributes such as onclick, onerror, or onload.
- Client-side error logs or Content Security Policy (CSP) reports citing inline script execution from custom element tags.
- Application logs showing user-submitted payloads with hyphenated tag names allowed by tagNameCheck.
Detection Strategies
- Inventory dependencies for DOMPurify versions earlier than 3.4.12 using software composition analysis tooling.
- Review application code for CUSTOM_ELEMENT_HANDLING.tagNameCheck usage combined with reliance on afterSanitizeElements for attribute filtering.
- Add unit tests that pass malicious attributes on allowlisted custom elements and assert their removal after sanitization.
Monitoring Recommendations
- Enable and monitor CSP violation reports for script-src and inline-handler violations on pages that render sanitized content.
- Instrument web application firewall (WAF) rules to flag payloads containing custom element tag patterns with event-handler attributes.
- Track dependency manifests in CI to alert when DOMPurify is pinned below 3.4.12.
How to Mitigate CVE-2026-66010
Immediate Actions Required
- Upgrade DOMPurify to version 3.4.12 or later across all applications and bundled dependencies.
- Audit sanitizer configurations for CUSTOM_ELEMENT_HANDLING.tagNameCheck and validate that attribute filtering does not depend solely on afterSanitizeElements.
- Re-scan stored user content for allowlisted custom elements carrying event-handler attributes and purge affected records.
Patch Information
The DOMPurify maintainers addressed the issue in version 3.4.12. The fix restores execution of the afterSanitizeElements hook for custom elements permitted through tagNameCheck. See the GitHub Security Advisory for the release notes and commit references.
Workarounds
- Disable CUSTOM_ELEMENT_HANDLING.tagNameCheck until the upgrade is deployed, forcing custom elements to be stripped.
- Move attribute filtering into the uponSanitizeAttribute hook, which continues to fire for custom elements, instead of afterSanitizeElements.
- Enforce a strict CSP that blocks inline event handlers to reduce the impact of any bypassed sanitization output.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
