Back to overview

CVE-2026-65904

MEDIUM
4.7
CVSS 3.1
Description
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact. The vendor considers this an edge case outside DOMPurify's threat model and, at time of publication, no fix was planned.

Metadata

CVE ID
CVE-2026-65904
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-07-23 11:03 UTC
Published
2026-07-23 13:16 UTC
Last updated
2026-07-23 13:16 UTC
Primary CWE
CWE-754
Improper Check for Unusual or Exceptional Conditions
Vendor / Product
cure53 / DOMPurify
Sources
cve.org  ·  NVD

Severity & Metrics

4.7 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products (1)
VendorProductPlatformVersions
cure53 DOMPurify — 0 < 3.4.4, 3.4.4
Weakness (CWE)
CWESourceDescription
CWE-754 cna Improper Check for Unusual or Exceptional Conditions
CVSS scores (2)
ScoreSeverityVersionSourceVector
4.7 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
2.3 LOW 4.0 cna CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
References (2)
Back to overview