Cross-Site Scripting Vulnerability in DOMPurify Affects Multiple Web Applications

CVE-2026-65904

What is CVE-2026-65904?

DOMPurify versions prior to 3.4.4 contain a vulnerability that fails to properly sanitize DOM elements when using IN_PLACE mode. This occurs particularly when elements are sourced from different browsing contexts, such as iframes. The issue arises due to an inadequate cross-realm check in the private _isNode() function, where foreign-realm nodes are incorrectly processed. Consequently, DOMPurify may output unsanitized elements, potentially exposing applications to XSS attacks. The vendor has classified this as an edge case and has not announced a fix.

References