CVE-2026-65901
MEDIUMDOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName
Title source: cnaDescription
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-x4vx-rjvf-j5p4)
https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4
Third Party Advisory third-party-advisory
VulnCheck Advisory: DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName
https://www.vulncheck.com/advisories/dompurify-cross-site-scripting-via-in-place-nodename
Scores
CVSS v3
6.1
EPSS
0.0017
EPSS Percentile
6.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Products (3)
cure53/DOMPurify
< 3.4.6
cure53/dompurify
< 3.4.7
npm/dompurify
0 - 3.4.6npm
Published
Jul 23, 2026
Tracked Since
Jul 23, 2026