CVE-2026-65901

DOMPurify 3.4.6 has a cross-site scripting vulnerability in IN_PLACE mode where attacker-controlled nodeName on live non-form nodes can cause scripts to execute when the sanitized tree is inserted into a live document. Attackers can supply hostile live DOM objects with real script children whose ...

PT-2026-63987

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements,...

DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects

Summary When DOMPurify.sanitizeroot, INPLACE: true is called on an attacker-supplied live DOM node, DOMPurify still trusts currentNode.nodeName for non-form nodes in the main sanitizeElements pipeline. A real child node whose observable nodeName is attacker-controlled can therefore be misclassifi...