Cross-Site Scripting Vulnerability in DOMPurify by Cure53
CVE-2026-65901

5.1MEDIUM

Key Information:

Vendor

Cure53

Status
Dompurify
Vendor
CVE Published:
23 July 2026

What is CVE-2026-65901?

DOMPurify version 3.4.6 is susceptible to a cross-site scripting vulnerability in its IN_PLACE mode, where it inaccurately trusts the nodeName of attacker-controlled live non-form nodes. This flaw enables attackers to inject malicious live DOM objects containing actual script children. When such a script is inserted into a live document, the observable nodeName can be manipulated to mimic permitted elements, leading to unintended script execution. Proper sanitization measures should be implemented to safeguard against potential exploitation.

Affected Version(s)

DOMPurify 0 <= 3.4.6

References

https://github.com/cure53/DOMPurify/security/advisories/G...
vendor-advisory
https://www.vulncheck.com/advisories/dompurify-cross-site...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.