CVE-2026-49459
published 2026-07-14CVE-2026-49459: DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve…
PriorityP429medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.36%
29.1th percentile
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.
Affected
46 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| advanced-cluster-security | rhacs-main-rhel8 | — | — |
| advanced-cluster-security | rhacs-main-rhel9 | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-27 | gateway-rhel9 | — | — |
| ansible-automation-platform | automation-portal | — | — |
| container-native-virtualization | kubevirt-console-plugin | — | — |
| container-native-virtualization | kubevirt-console-plugin-rhel9 | — | — |
| cure53 | dompurify | < 3.4.6 | 3.4.6 |
| cure53 | dompurify | — | — |
| cure53 | dompurify | >= 0 < 3.4.6 | 3.4.6 |
| devspaces | code-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| migration-toolkit-virtualization | mtv-console-plugin-rhel9 | — | — |
| mtv-candidate | mtv-console-plugin-rhel9 | — | — |
| multicluster-engine | console-mce-rhel9 | — | — |
| odf4 | ocs-client-console-rhel9 | — | — |
| odf4 | odf-console-rhel9 | — | — |
| odf4 | odf-multicluster-console-rhel9 | — | — |
| openshift-gitops-1 | argocd-rhel8 | — | — |
| openshift-gitops-1 | argocd-rhel9 | — | — |
| openshift-lightspeed | lightspeed-agentic-console-rhel9 | — | — |
| openshift-lightspeed | lightspeed-console-plugin-419-rhel9 | — | — |
| openshift-lightspeed | lightspeed-console-plugin-pf5-rhel9 | — | — |
| openshift-lightspeed | lightspeed-console-plugin-rhel9 | — | — |
| openshift-service-mesh | kiali-ossmc-rhel9 | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
dompurify: DOMPurify: Cross-site scripting bypass allows arbitrary script execution
vendor_redhat·2026-07-14·CVSS 6.1
CVE-2026-49459 [MEDIUM] CWE-79 dompurify: DOMPurify: Cross-site scripting bypass allows arbitrary script execution
dompurify: DOMPurify: Cross-site scripting bypass allows arbitrary script execution
A flaw was found in DOMPurify, a library designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. A remote attacker could exploit a vulnerability in the `DOMPurify.sanitize` function when used with the `IN_PLACE: true` option. This flaw allows an attacker to bypass the sanitizer and inject malicious event-handler attributes into an attacker-controlled form element. Successful exploitation could lead to the execution of arbitrary scripts in the user's browser, potentially compromising user data or session integrity.
Statement: This Moderate-impact cross-site scripting (XSS) bypass in DOMPurify arises when the `DOMPurify.sanitize` function is invoked with the `IN_PLACE: true
VulDB
cure53 DOMPurify up to 3.4.5 sanitize root cross site scripting
vuldb·2026-07-15·CVSS 6.1
CVE-2026-49459 [MEDIUM] cure53 DOMPurify up to 3.4.5 sanitize root cross site scripting
A vulnerability labeled as problematic has been found in cure53 DOMPurify up to 3.4.5. Affected is the function sanitize. The manipulation of the argument root results in cross site scripting.
This vulnerability was named CVE-2026-49459. The attack may be performed from remote. There is no available exploit.
GHSA
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
ghsa·2026-06-15
CVE-2026-49459 [MEDIUM] CWE-79 DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
# IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
**CWE**: CWE-79 (XSS — Improper Neutralization of Input During Web Page Generation) via CWE-693 (Protection Mechanism Failure — silent no-op when `_forceRemove` is called on a parent-less node)
## Summary
When `DOMPurify.sanitize(root, { IN_PLACE: true })` is called and `root` is a `` whose own attributes carry an event handler (`onmouseover`, `onfocus`, `onclick`, etc.), a single descendant element with a `name=` attribute matching any of the property names `_isClobbered` checks (`nodeName`, `setAttribute`, `namespaceURI`, `insertBefore`, `hasChildNodes`,
No detection rules found.
No public exploits indexed.
2026-07-14
Published