CVE-2026-65901 | DOMPurify through 3.4.6 contains a cross-site scripting vuln… | CVSS 6.1 MEDIUM

Description

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.

Metadata

CVE ID: CVE-2026-65901
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-23 11:03 UTC
Published: 2026-07-23 13:16 UTC
Last updated: 2026-07-23 13:39 UTC
Primary CWE: CWE-79
Improper Neutralization of Input During Web Page Generation …
Vendor / Product: cure53 / DOMPurify
Sources: cve.org · NVD

Severity & Metrics

6.1 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
cure53	DOMPurify	—	0 ≤ 3.4.6

Weakness (CWE)

CWE	Source	Description
CWE-79	cna	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS scores (2)

Score	Severity	Version	Source	Vector
6.1	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
5.1	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References (2)

GitHub Security Advisory (GHSA-x4vx-rjvf-j5p4) https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4
VulnCheck Advisory: DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName https://www.vulncheck.com/advisories/dompurify-cross-site-scripting-via-in-place-nodename