Vulnerability · Published Jul 23, 2026 · Assigned by VulnCheck

CVE-2026-65901DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName

Medium 6.1

In plain English

A medium-severity cross-site scripting in DOMPurify from cure53. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.3%top 78.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	node-dompurify	no fix listed	DEBIAN-CVE-2026-65901
Debian:13	node-dompurify	no fix listed	DEBIAN-CVE-2026-65901
Debian:14	node-dompurify	3.4.12+dfsg-1	DEBIAN-CVE-2026-65901
Ubuntu:22.04:LTS	node-dompurify	no fix listed	UBUNTU-CVE-2026-65901
Ubuntu:24.04:LTS	node-dompurify	no fix listed	UBUNTU-CVE-2026-65901
Ubuntu:26.04:LTS	node-dompurify	no fix listed	UBUNTU-CVE-2026-65901
Ubuntu:26.10	node-dompurify	no fix listed	UBUNTU-CVE-2026-65901
npm	dompurify	no fix listed	GHSA-x4vx-rjvf-j5p4

Affected products (as reported)

Vendor	Product	Versions
cure53	DOMPurify	0 – through 3.4.6

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-x4vx-rjvf-j5p4) vendor-advisory
VulnCheck Advisory: DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName third-party-advisory