CVE-2026-65901
published 2026-07-23CVE-2026-65901: DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes…
PriorityP426medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.29%
20.0th percentile
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cure53 | dompurify | < 3.4.7 | 3.4.7 |
| cure53 | dompurify | <= 3.4.6 | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv4.05.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-65901 forgejo: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65901 [MEDIUM] CVE-2026-65901 forgejo: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [epel-all]
CVE-2026-65901 forgejo: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
Bugzilla
CVE-2026-65901 openbao: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65901 [MEDIUM] CVE-2026-65901 openbao: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [fedora-all]
CVE-2026-65901 openbao: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
Bugzilla
CVE-2026-65901 cachelib: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65901 [MEDIUM] CVE-2026-65901 cachelib: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [epel-all]
CVE-2026-65901 cachelib: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
Bugzilla
CVE-2026-65901 jupyterlab: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65901 [MEDIUM] CVE-2026-65901 jupyterlab: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [fedora-all]
CVE-2026-65901 jupyterlab: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
Bugzilla
CVE-2026-65901 openbao: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65901 [MEDIUM] CVE-2026-65901 openbao: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [epel-all]
CVE-2026-65901 openbao: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
Bugzilla
CVE-2026-65901 forgejo: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65901 [MEDIUM] CVE-2026-65901 forgejo: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [fedora-all]
CVE-2026-65901 forgejo: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
Bugzilla
CVE-2026-65901 cachelib: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65901 [MEDIUM] CVE-2026-65901 cachelib: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [fedora-all]
CVE-2026-65901 cachelib: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
Bugzilla
CVE-2026-65901 ansible-collection-awx-awx: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65901 [MEDIUM] CVE-2026-65901 ansible-collection-awx-awx: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [epel-all]
CVE-2026-65901 ansible-collection-awx-awx: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
Bugzilla
CVE-2026-65901 jupyterlab: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65901 [MEDIUM] CVE-2026-65901 jupyterlab: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [epel-all]
CVE-2026-65901 jupyterlab: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
Bugzilla
CVE-2026-65901 fbthrift: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65901 [MEDIUM] CVE-2026-65901 fbthrift: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [epel-all]
CVE-2026-65901 fbthrift: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
Bugzilla
CVE-2026-65901 fbthrift: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65901 [MEDIUM] CVE-2026-65901 fbthrift: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [fedora-all]
CVE-2026-65901 fbthrift: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
Bugzilla
CVE-2026-65901 nextcloud: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [epel-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65901 [MEDIUM] CVE-2026-65901 nextcloud: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [epel-all]
CVE-2026-65901 nextcloud: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
Discussion:
This bug is not valid. As of this writing, the current Nextcloud
Bugzilla
CVE-2026-65901 nextcloud: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65901 [MEDIUM] CVE-2026-65901 nextcloud: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [fedora-all]
CVE-2026-65901 nextcloud: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
Discussion:
This bug is not valid. As of this writing, the current Nextclou
Bugzilla
CVE-2026-65901 grafana: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [fedora-all]
bugzilla·2026-08-20·CVSS 6.1
CVE-2026-65901 [MEDIUM] CVE-2026-65901 grafana: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [fedora-all]
CVE-2026-65901 grafana: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
Bugzilla
CVE-2026-65901 dompurify: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName
bugzilla·2026-07-23·CVSS 6.1
CVE-2026-65901 [MEDIUM] CVE-2026-65901 dompurify: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName
CVE-2026-65901 dompurify: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
2026-07-23
Published