CVE-2026-65901

MEDIUM

DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName

Title source: cna
STIX 2.1

Description

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.

References (2)

Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-x4vx-rjvf-j5p4)
https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4
Third Party Advisory third-party-advisory
VulnCheck Advisory: DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName
https://www.vulncheck.com/advisories/dompurify-cross-site-scripting-via-in-place-nodename

Scores

CVSS v3 6.1
EPSS 0.0017
EPSS Percentile 6.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (3)
cure53/DOMPurify < 3.4.6
cure53/dompurify < 3.4.7
npm/dompurify 0 - 3.4.6npm
Published Jul 23, 2026
Tracked Since Jul 23, 2026