Prototype Pollution

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Prototype Pollution in the INPLACE function when sanitizing a root element that is a with event handler attributes and a descendant element whose name attribute matches...

NPM: DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

NPM: DOMPurify: INPLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM vulnerability discovered by ? in WordPress Npm dompurify versions = 3.4.5...

1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2176 more potentially affected by CVE-2026-49459 via dompurify (>=3.0.0, <=3.4.5)

dompurify NPM version =3.0.0, =0.3.96, =0.5.12, =0.3.33, =0.3.0, =0.5.0, =0.4.71, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.0.0-dev-20240828032938, =6.3.4 and more Source cves: CVE-2026-49459 Source advisory: SNYK:JS-DOMPURIFY-17344538...

GHSA-R47G-FVHR-H676 DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

INPLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM CWE: CWE-79 XSS — Improper Neutralization of Input During Web Page Generation via CWE-693 Protection Mechanism Failure — silent no-op when forceRemove is called on a parent-less node Summa...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +39 more potentially affected by CVE-2026-50171 via @angular/common (>=19.0.0, <=19.2.20)

@angular/common NPM version =19.0.0, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.0.5, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.0.0-beta-20260114160010, =0.0.1-canary.0.0, =1.0.0-canary.1 and more Source cves: CVE-2026-50171 Source advisory:...

PT-2026-63985

Name of the Vulnerable Software and Affected Versions DOMPurify versions 3.0.0 through 3.4.8 Description The software fails to reset the retained Trusted Types policy when the clearConfig function is called. Consequently, a DOMPurify instance reused across trust boundaries remains bound to a...

PT-2026-63986

Name of the Vulnerable Software and Affected Versions DOMPurify versions 3.0.0 through 3.4.7 Description When configured with SAFE FOR TEMPLATES and a DOM output mode RETURN DOM, RETURN DOM FRAGMENT, or IN PLACE, the software fails to strip template expressions such as $evil, evil, or within...

PT-2026-50852

Summary When DOMPurify.sanitizeroot, IN PLACE: true is called on an attacker-supplied live DOM node, DOMPurify still trusts currentNode.nodeName for non-form nodes in the main sanitizeElements pipeline. A real child node whose observable nodeName is attacker-controlled can therefore be...

PT-2026-49557

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.4.6 Description DOMPurify fails to properly sanitize DOM nodes from same-origin foreign realms such as those from an iframe, popup window, or opened tab when using the DOMPurify.sanitizenode, IN PLACE: true method...

PT-2026-49558

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.4.6 Description When using DOMPurify.sanitizeroot, IN PLACE: true with a element as the root, an attacker can bypass attribute sanitization. This occurs if a descendant element has a name attribute that clobbers...

PT-2026-63988

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.4.7 Description When the sanitize function is called without an explicit cfg.ALLOWED TAGS or cfg.ALLOWED ATTR array, direct references to the module-level DEFAULT ALLOWED TAGS and DEFAULT ALLOWED ATTR sets are...

PT-2026-63987

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.4.7 Description A cross-site scripting issue exists when using IN PLACE mode. The software trusts the nodeName of live non-form nodes, which can be controlled by an attacker. By providing hostile live DOM objects...

PT-2026-49559

Name of the Vulnerable Software and Affected Versions DOMPurify affected versions not specified Description An issue exists where the sanitizer skips the contents of a shadow DOM attached to an element inside a element. This allows malicious payloads, such as images with onerror handlers, links...

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition

Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate Developer Edition version 2.11.0 Vulnerability Details CVEID:CVE-2026-40895 DESCRIPTION: follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. Prior...

Security Bulletin: IBM Maximo Scheduler Optimizer uses dompurify-3.2.4.tgz which is vulnerable to CVE-2025-15599, CVE-2026-0540

Summary IBM Maximo Scheduler Optimizer uses dompurify-3.2.4.tgz which is vulnerable to CVE-2025-15599, CVE-2026-0540. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2025-15599 DESCRIPTION: DOMPurify 3.1.3 through 3.2.6 and 2.5.3...

PT-2026-50814

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 6.0 through 9.15 Description Stored cross-site scripting exists in the error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server, such as ErrorResponse messages, object names in...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in dompurify-3.2.6.tgz

Summary IBM Watson Discovery Cartridge affected by vulnerability in dompurify-3.2.6.tgz Vulnerability Details CVEID:CVE-2025-15599 DESCRIPTION: DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerabilities in dompurify-3.2.6.tgz

Summary IBM Watson Discovery Cartridge affected by vulnerabilities in dompurify-3.2.6.tgz Vulnerability Details CVEID:CVE-2026-41238 DESCRIPTION: DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype...

CVE-2026-44568

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the AccountPending.svelte component renders the admin-configured "Pending User Overlay Content" using marked.parse inside @html with an incorrect DOMPurify application order. An admi...

Security update for cacti (moderate)

openSUSE Security Update: Security update for cacti Announcement ID: openSUSE-SU-2026:0189-1 Rating: moderate References: Cross-References: CVE-2024-27355 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available. Description: This update for cacti...