Medium [CVE-2026-65903] Security bypass allows injection of malicious content

DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.

A flaw was found in DOMPurify. By crafting specific input, an attacker can cause tags that should be removed to remain in the sanitized output.

This could lead to the injection of malicious content, potentially compromising the integrity of web pages. This Moderate flaw in DOMPurify allows an attacker to bypass content sanitization by crafting specific input, leading to the injection of malicious content.

Exploitation requires user interaction, as an attacker must trick a user into processing the specially crafted input. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Weakness: CWE-79.

Affected products named by the advisory: Cryostat 4; Migration Toolkit for Virtualization; Multicluster Engine for Kubernetes; Node HealthCheck Operator; and 30 more.

Affected products named by the advisory: OpenShift Lightspeed; OpenShift Service Mesh 3; Red Hat 3scale API Management Platform 2; Red Hat Advanced Cluster Management for Kubernetes 2; and 26 more.