Skip to main content

DOMPurify EUVDEUVD-2026-48270

| CVE-2026-65901 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-07-23 VulnCheck
XSS Dompurify Suse Red Hat
5.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.7 MEDIUM

AC:H reflects the same-origin and IN_PLACE-mode prerequisites; S:C and UI:R capture victim-browser XSS with user interaction; no confidentiality or integrity impact on the vulnerable system itself.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
SUSE
6.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Red Hat
6.1 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Jul 23, 2026 - 13:54 vuln.today
Analysis Generated
Jul 23, 2026 - 13:54 vuln.today
CVE Published
Jul 23, 2026 - 13:16 cve.org
MEDIUM 5.1

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 37 npm packages depend on dompurify (3 direct, 34 indirect)

Ecosystem-wide dependent count for version 3.4.6.

DescriptionCVE.org

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.

AnalysisAI

Cross-site scripting in DOMPurify 3.4.6 and earlier enables script execution when the library's IN_PLACE sanitization mode processes attacker-supplied live DOM nodes whose nodeName property has been clobbered to masquerade as an allowed element. The vulnerability bypasses DOMPurify's existing clobbering protections, which were scoped only to form elements, leaving all other live non-form nodes susceptible to nodeName manipulation. No vendor-released patch exists at time of analysis; no public exploit code has been identified, though the GHSA advisory provides a detailed technical breakdown sufficient for exploit construction.

Technical ContextAI

DOMPurify (cure53/dompurify, CPE cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*) is a widely used npm library for sanitizing HTML and DOM content to prevent XSS (CWE-79). The library supports two primary input modes: string-based sanitization, which serializes and re-parses HTML into a clean tree, and IN_PLACE mode (IN_PLACE: true), which operates directly on a live DOM node passed by reference. In IN_PLACE mode, the _sanitizeElements function reads currentNode.nodeName to determine whether an element should be permitted or removed. A prior hardening pass introduced _isClobbered() to detect and reject form nodes whose nodeName had been clobbered via DOM property shadowing, but _isClobbered() explicitly returns false for any element that is not a form. Consequently, an attacker can supply a live DOM object - sourced from a same-origin iframe, a same-origin window.open() popup, or a node adopted via document.adoptNode() - that carries a real script child whose nodeName is overridden to resemble an allowed tag. DOMPurify classifies it as benign, retains it in the sanitized tree, and when the tree is inserted into a live document the script executes. String-based sanitization paths are entirely unaffected.

RemediationAI

No vendor-released patch has been identified at time of analysis; the package metadata confirms fixed in: None, and the GHSA advisory at https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4 does not specify a remediated release. The primary compensating control is to avoid calling DOMPurify.sanitize() in IN_PLACE mode on any DOM node sourced from an untrusted or attacker-influenced origin; switching to string-based sanitization via DOMPurify.sanitize(dirtyString) (without the IN_PLACE option) is unaffected by this vulnerability and eliminates the attack surface entirely. Applications that must use IN_PLACE mode should validate that input nodes originate exclusively from fully trusted, application-controlled sources - not from cross-iframe references, popups, or document.adoptNode() on externally sourced nodes - treating any such node as untrusted regardless of apparent origin. Monitor the DOMPurify GitHub repository and npm release feed for a patched version.

More in Dompurify

View all
CVE-2024-47875 MEDIUM POC
6.1 Oct 11

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated medium severity (CVSS 6
CVE-2020-26870 MEDIUM POC
6.1 Oct 07

Cure53 DOMPurify before 2.0.17 allows mutation XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp
CVE-2019-16728 MEDIUM POC
6.1 Sep 24

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demo
CVE-2024-48910 CRITICAL
9.8 Oct 31

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated critical severity (CVSS
CVE-2026-65914 MEDIUM POC
5.3 Jul 23

Mutation-XSS in DOMPurify before 3.3.2 enables JavaScript execution in victim browsers when sanitized output is re-inser
CVE-2026-65902 MEDIUM POC
5.3 Jul 23

Hook mutation pollution in DOMPurify <= 3.4.5 allows persistent bypass of HTML sanitization defaults when application-in
CVE-2026-65899 MEDIUM POC
5.1 Jul 23

Trusted Types policy state contamination in DOMPurify 3.0.0-3.4.8 allows a previously supplied TRUSTED_TYPES_POLICY to s
CVE-2026-65913 MEDIUM POC
5.1 Jul 23

Prototype pollution in DOMPurify's USE_PROFILES mode enables DOM-based XSS by causing the sanitizer to accept event hand
CVE-2026-65912 MEDIUM POC
5.1 Jul 23

URI validation bypass in DOMPurify 3.3.1 and earlier allows `javascript:` protocol payloads to survive HTML sanitization
CVE-2026-65900 MEDIUM POC
5.1 Jul 23

SAFE_FOR_TEMPLATES bypass in DOMPurify 3.0.0-3.4.7 allows template expressions such as ${evil}, {{evil}}, and <%evil%> t
CVE-2026-65898 MEDIUM POC
5.1 Jul 23

Stored XSS is achievable in applications using DOMPurify's setConfig() API combined with an uponSanitizeAttribute hook t
CVE-2025-26791 MEDIUM POC
4.5 Feb 14

DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site sc

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Module for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise Server for SAP applications 16.0 Affected

Share

EUVD-2026-48270 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy