CVE-2026-49459

MediumCVSS 6.1/10Last modified Oct 24, 2026

Description

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-693 CWE-1321

Affected software

Vendor	Product	Versions
cure53	DOMPurify	< 3.4.6

References

https://github.com/cure53/DOMPurify/commit/bb7739e5bccec7e1ab3dae3f3e42d02db3acaaaePatch
https://github.com/cure53/DOMPurify/releases/tag/3.4.6Release Notes
https://github.com/cure53/DOMPurify/security/advisories/GHSA-r47g-fvhr-h676Exploit, Mitigation, Vendor Advisory
https://github.com/cure53/DOMPurify/security/advisories/GHSA-r47g-fvhr-h676Exploit, Mitigation, Vendor Advisory

Timeline

Published: Jul 14, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-49468.8Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbit CVE-2026-494603.3pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which lead CVE-2026-494615.5pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which lead CVE-2026-494625.3NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and CVE-2026-494636.5NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and CVE-2026-494648.1NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and CVE-2026-494657.7n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create o CVE-2026-494666.5Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scr CVE-2026-494678.8Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker t CVE-2026-494689.8LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the Lit CVE-2026-494694.6GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can sub CVE-2026-49477.1Addressed a potential insecure direct object reference (IDOR) vulnerability in the signing invitation acceptance process. Under certain cond