CVE-2026-65904
MEDIUMDOMPurify before 3.4.4 Cross-Site Scripting via IN_PLACE mode
Title source: cnaDescription
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.
References (2)
Core 2
Core References
Third Party Advisory third-party-advisory
VulnCheck Advisory: DOMPurify before 3.4.4 Cross-Site Scripting via IN_PLACE mode
https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-mode
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-4w3q-35jp-p934)
https://github.com/cure53/DOMPurify/security/advisories/GHSA-4w3q-35jp-p934
Scores
CVSS v3
4.7
EPSS
0.0016
EPSS Percentile
6.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-754
Status
published
Products (4)
cure53/DOMPurify
< 3.3.3
cure53/DOMPurify
< 3.4.4
cure53/dompurify
< 3.4.4
cure53/DOMPurify
3.4.4
Published
Jul 23, 2026
Tracked Since
Jul 23, 2026