ROOT-APP-NPM-CVE-2026-49978 CVE-2026-49978 in dompurify - Patched by Root

🗓️ 31 Aug 2026 15:55:06Reported by GoogleType

osv🔗 osv.dev👁 15 Views

Root patched a security vulnerability in the dompurify package for Root npm; multiple fixed versions available.

Reporter	Title	Published	Views	Family All 199
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.	9 Sep 202607:24	–	ibm
IBM Security Bulletins	Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in DOMPurify	4 Sep 202613:35	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in DOMPurify affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:28	–	ibm
IBM Security Bulletins	Security Bulletin: Cyber Fraud includes components with multiple known vulnerabilities	6 Aug 202613:11	–	ibm
IBM Security Bulletins	Security Bulletin: Resolved multiple XSS vulnerabilities in DOMPurify (CVE-2026-49978, CVE-2026-65898, CVE-2026-66010, and others)	31 Aug 202615:05	–	ibm
IBM Security Bulletins	Security Bulletin: Resolved multiple XSS vulnerabilities in DOMPurify (CVE-2026-49978, CVE-2026-65898, CVE-2026-66010, and others)	7 Aug 202609:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.	31 Aug 202609:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Suite Software includes components with multiple known vulnerabilities	24 Aug 202611:23	–	ibm
IBM Security Bulletins	Security Bulletin: Resolved multiple XSS vulnerabilities in DOMPurify (CVE-2026-49978, CVE-2026-65898, CVE-2026-66010, and others)	7 Aug 202609:29	–	ibm
Chainguard	CVE-2026-49978 vulnerabilities	18 Jun 202620:21	–	cgr

31 Aug 2026 16:45Current

7.2High risk

Vulners AI Score7.2

CVSS 3.16.1

CVSS 46.3

EPSS0.00334

SSVC