CVE-2026-49458
published 2026-07-14CVE-2026-49458: DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted…
PriorityP427medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.38%
30.9th percentile
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches so executable markup could survive. This issue is fixed in version 3.4.6.
Affected
46 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| advanced-cluster-security | rhacs-main-rhel8 | — | — |
| advanced-cluster-security | rhacs-main-rhel9 | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-27 | gateway-rhel9 | — | — |
| ansible-automation-platform | automation-portal | — | — |
| container-native-virtualization | kubevirt-console-plugin | — | — |
| container-native-virtualization | kubevirt-console-plugin-rhel9 | — | — |
| cure53 | dompurify | < 3.4.6 | 3.4.6 |
| cure53 | dompurify | — | — |
| cure53 | dompurify | >= 0 < 3.4.6 | 3.4.6 |
| devspaces | code-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| migration-toolkit-virtualization | mtv-console-plugin-rhel9 | — | — |
| mtv-candidate | mtv-console-plugin-rhel9 | — | — |
| multicluster-engine | console-mce-rhel9 | — | — |
| odf4 | ocs-client-console-rhel9 | — | — |
| odf4 | odf-console-rhel9 | — | — |
| odf4 | odf-multicluster-console-rhel9 | — | — |
| openshift-gitops-1 | argocd-rhel8 | — | — |
| openshift-gitops-1 | argocd-rhel9 | — | — |
| openshift-lightspeed | lightspeed-agentic-console-rhel9 | — | — |
| openshift-lightspeed | lightspeed-console-plugin-419-rhel9 | — | — |
| openshift-lightspeed | lightspeed-console-plugin-pf5-rhel9 | — | — |
| openshift-lightspeed | lightspeed-console-plugin-rhel9 | — | — |
| openshift-service-mesh | kiali-ossmc-rhel9 | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
dompurify: DOMPurify: Cross-site scripting due to improper sanitization of DOM nodes
vendor_redhat·2026-07-14·CVSS 6.1
CVE-2026-49458 [MEDIUM] CWE-79 dompurify: DOMPurify: Cross-site scripting due to improper sanitization of DOM nodes
dompurify: DOMPurify: Cross-site scripting due to improper sanitization of DOM nodes
A flaw was found in DOMPurify, a tool designed to prevent cross-site scripting (XSS) attacks by sanitizing HTML, MathML, and SVG content. When processing certain types of web page elements, DOMPurify failed to properly identify and sanitize malicious code. This oversight could allow an attacker to inject and execute harmful scripts within a user's web browser, potentially leading to information disclosure or unauthorized actions.
Statement: This Moderate cross-site scripting (XSS) flaw in DOMPurify arises when the `DOMPurify.sanitize()` function is used with the `IN_PLACE: true` option on DOM nodes originating from a different realm (e.g., an iframe). This misconfiguration bypasses critical sanitization
VulDB
cure53 DOMPurify up to 3.4.5 DOM Sanitizer sanitize cross site scripting
vuldb·2026-07-15·CVSS 6.1
CVE-2026-49458 [MEDIUM] cure53 DOMPurify up to 3.4.5 DOM Sanitizer sanitize cross site scripting
A vulnerability identified as problematic has been detected in cure53 DOMPurify up to 3.4.5. Affected by this issue is the function sanitize of the component DOM Sanitizer. This manipulation causes cross site scripting.
This vulnerability is handled as CVE-2026-49458. The attack can be initiated remotely. There is not any exploit available.
GHSA
DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
ghsa·2026-06-15
CVE-2026-49458 [MEDIUM] CWE-79 DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
# Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
**CWE**: CWE-79 (XSS — Improper Neutralization of Input During Web Page Generation) via CWE-693 (Protection Mechanism Failure — realm-bound `instanceof` checks fail-open on foreign-realm DOM nodes) and CWE-501 (Trust Boundary Violation — foreign-realm nodes accepted for sanitization but later checks are bound to the parent realm)
## Summary
`DOMPurify.sanitize(node, { IN_PLACE: true })` accepts a DOM node from any same-origin realm (e.g. a node owned by an application-created iframe document), but several follow-on security checks compare the node against constructors from
No detection rules found.
No public exploits indexed.
2026-07-14
Published