CVE-2026-65904

MediumCVSS 4.7/10Last modified Oct 24, 2026

Description

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-754

Affected software

Vendor	Product	Versions
cure53	DOMPurify	<= 3.3.3

References

https://github.com/cure53/DOMPurify/security/advisories/GHSA-4w3q-35jp-p934Exploit, Third Party Advisory
https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-modeThird Party Advisory
https://github.com/cure53/DOMPurify/security/advisories/GHSA-4w3q-35jp-p934Exploit, Third Party Advisory

Timeline

Published: Jul 23, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-659059.8Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made CVE-2026-6590610.0In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible CVE-2026-659079.1In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible CVE-2026-659088.6In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open CVE-2026-65914.3A flaw has been found in ComfyUI up to 0.13.0. Affected is the function folder_paths.get_annotated_filepath of the file folder_paths.py of t CVE-2026-659116.1In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_E CVE-2026-659126.1DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HA CVE-2026-659136.1DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering CVE-2026-659146.1DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML CVE-2026-659156.5NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized pat CVE-2026-659168.1CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that a CVE-2026-659178.8CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups appli