dompurify: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName

A flaw was found in DOMPurify. This cross-site scripting XSS vulnerability exists in INPLACE mode, where the software trusts attacker-controlled nodeName on live non-form nodes. A remote attacker can supply hostile live Document Object Model DOM objects with script children. These scripts can...

dompurify: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName

A flaw was found in DOMPurify. This cross-site scripting XSS vulnerability exists in INPLACE mode, where the software trusts attacker-controlled nodeName on live non-form nodes. A remote attacker can supply hostile live Document Object Model DOM objects with script children. These scripts can...

CVE-2026-65904

A flaw was found in DOMPurify. When DOM elements originating from a different window or realm, such as an iframe's contentDocument, are processed in INPLACE mode, DOMPurify fails to properly sanitize them. This oversight allows an attacker to inject and execute Cross-Site Scripting XSS payloads,...

CVE-2026-65901

A flaw was found in DOMPurify. This cross-site scripting XSS vulnerability exists in INPLACE mode, where the software trusts attacker-controlled nodeName on live non-form nodes. A remote attacker can supply hostile live Document Object Model DOM objects with script children. These scripts can...

DOMPurify: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms

A flaw was found in DOMPurify. When DOM elements originating from a different window or realm, such as an iframe's contentDocument, are processed in INPLACE mode, DOMPurify fails to properly sanitize them. This oversight allows an attacker to inject and execute Cross-Site Scripting XSS payloads,...

Improper Check for Unusual or Exceptional Conditions

Overview org.webjars.npm:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions in the INPLACE process when DOM elements are passed from a different window or realm, such as an iframe...

CVE-2026-65904

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's contentDocument. A cross-realm instanceof check in the private isNode function returns false for foreign-realm nodes, causing DOMPurify to...

CVE-2026-65901

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in INPLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements,...

CVE-2026-65901: Improper Neutralization of Input During Web Page Generation

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in INPLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements,...

CVE-2026-65904: Improper Check for Unusual or Exceptional Conditions

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's contentDocument. A cross-realm instanceof check in the private isNode function returns false for foreign-realm nodes, causing DOMPurify to...