CVE-2026-65904
DOMPurify before 3.4.4 Cross-Site Scripting via IN_PLACE mode
CVSS Score
4.7
EPSS Score
0.0%
EPSS Percentile
0th
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact. The vendor considers this an edge case outside DOMPurify's threat model and, at time of publication, no fix was planned.
| CWE | CWE-754 |
| Vendor | cure53 |
| Product | dompurify |
| Published | Jul 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for cure53 dompurify
Be the first to know when new medium vulnerabilities affecting cure53 dompurify are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
cure53 / DOMPurify
0 < 3.4.4
References
Credits
🔍 fg0x0