Log in Start free

Vulnerability · Published Jul 14, 2026 · Assigned by GitHub_M

CVE-2026-49458DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

Medium 6.1

In plain English

A medium-severity cross-site scripting in DOMPurify from cure53. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.4%top 65.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches so executable markup could survive. This issue is fixed in version 3.4.6.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-dompurifyno fix listedDEBIAN-CVE-2026-49458
Debian:13node-dompurifyno fix listedDEBIAN-CVE-2026-49458
Debian:14node-dompurify3.4.12+dfsg-1DEBIAN-CVE-2026-49458
Ubuntu:22.04:LTSnode-dompurifyno fix listedUBUNTU-CVE-2026-49458
Ubuntu:24.04:LTSnode-dompurifyno fix listedUBUNTU-CVE-2026-49458
Ubuntu:26.04:LTSnode-dompurifyno fix listedUBUNTU-CVE-2026-49458
Ubuntu:26.10node-dompurifyno fix listedUBUNTU-CVE-2026-49458
npmdompurify3.4.6GHSA-hpcv-96wg-7vj8

Affected products (as reported)

VendorProductVersions
cure53 DOMPurify < 3.4.6

Weakness: CWE-79, CWE-501, CWE-693 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References