CVE-2026-65904
published 2026-07-23CVE-2026-65904: DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's…
PriorityP421medium4.7CVSS 3.1
AVNACHPRNUIRSCCLILAN
EPSS
0.27%
17.5th percentile
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.
Affected
51 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | system-rhel8 | — | — |
| advanced-cluster-security | rhacs-main-rhel8 | — | — |
| advanced-cluster-security | rhacs-main-rhel9 | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-27 | gateway-rhel9 | — | — |
| ansible-automation-platform | automation-portal | — | — |
| apicurio | apicurio-registry-ui-rhel8 | — | — |
| apicurio | apicurio-registry-ui-rhel9 | — | — |
| container-native-virtualization | kubevirt-console-plugin | — | — |
| container-native-virtualization | kubevirt-console-plugin-rhel9 | — | — |
| cure53 | dompurify | < 3.4.4 | 3.4.4 |
| cure53 | dompurify | <= 3.3.3 | — |
| debian | ceph | — | — |
| devspaces | code-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| grafana | grafana | — | — |
| migration-toolkit-virtualization | mtv-console-plugin-rhel9 | — | — |
| multicluster-engine | console-mce-rhel9 | — | — |
| odf4 | ocs-client-console-rhel9 | — | — |
| odf4 | odf-console-rhel9 | — | — |
| odf4 | odf-multicluster-console-rhel9 | — | — |
| openshift-gitops-1 | argocd-rhel8 | — | — |
| openshift-gitops-1 | argocd-rhel9 | — | — |
| openshift-lightspeed | lightspeed-agentic-console-rhel9 | — | — |
| openshift-lightspeed | lightspeed-console-plugin-419-rhel9 | — | — |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv4.02.3LOWCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
cure53 DOMPurify up to 3.4.3 _isNode cross site scripting (EUVD-2026-48273)
vuldb·2026-07-25·CVSS 4.7
CVE-2026-65904 [MEDIUM] cure53 DOMPurify up to 3.4.3 _isNode cross site scripting (EUVD-2026-48273)
A vulnerability, which was classified as problematic, was found in cure53 DOMPurify up to 3.4.3. This vulnerability affects the function _isNode. Executing a manipulation can lead to cross site scripting.
The identification of this vulnerability is CVE-2026-65904. The attack may be launched remotely. There is no exploit available.
You should upgrade the affected component.
Red Hat
DOMPurify: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms
vendor_redhat·2026-07-23·CVSS 4.7
CVE-2026-65904 [MEDIUM] CWE-79 DOMPurify: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms
DOMPurify: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.
A flaw was found in DOMPurify. When DOM elements originating from a different window or realm, such as an iframe's contentDocument, are processed in IN_PLACE mode, DOMPurify fails to properly sanitize them. This oversight allows an att
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-65904 grafana: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [fedora-all]
bugzilla·2026-08-24·CVSS 4.7
CVE-2026-65904 [MEDIUM] CVE-2026-65904 grafana: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [fedora-all]
CVE-2026-65904 grafana: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS pa
Bugzilla
CVE-2026-65904 jupyterlab: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [epel-all]
bugzilla·2026-08-24·CVSS 4.7
CVE-2026-65904 [MEDIUM] CVE-2026-65904 jupyterlab: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [epel-all]
CVE-2026-65904 jupyterlab: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS p
Bugzilla
CVE-2026-65904 nextcloud: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [fedora-all]
bugzilla·2026-08-24·CVSS 4.7
CVE-2026-65904 [MEDIUM] CVE-2026-65904 nextcloud: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [fedora-all]
CVE-2026-65904 nextcloud: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS
Bugzilla
CVE-2026-65904 nextcloud: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [epel-all]
bugzilla·2026-08-24·CVSS 4.7
CVE-2026-65904 [MEDIUM] CVE-2026-65904 nextcloud: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [epel-all]
CVE-2026-65904 nextcloud: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS pa
Bugzilla
CVE-2026-65904 ansible-collection-awx-awx: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [epel-all]
bugzilla·2026-08-24·CVSS 4.7
CVE-2026-65904 [MEDIUM] CVE-2026-65904 ansible-collection-awx-awx: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [epel-all]
CVE-2026-65904 ansible-collection-awx-awx: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchange
Bugzilla
CVE-2026-65904 forgejo: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [epel-all]
bugzilla·2026-08-24·CVSS 4.7
CVE-2026-65904 [MEDIUM] CVE-2026-65904 forgejo: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [epel-all]
CVE-2026-65904 forgejo: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payl
Bugzilla
CVE-2026-65904 forgejo: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [fedora-all]
bugzilla·2026-08-24·CVSS 4.7
CVE-2026-65904 [MEDIUM] CVE-2026-65904 forgejo: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [fedora-all]
CVE-2026-65904 forgejo: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS pa
Bugzilla
CVE-2026-65904 jupyterlab: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [fedora-all]
bugzilla·2026-08-24·CVSS 4.7
CVE-2026-65904 [MEDIUM] CVE-2026-65904 jupyterlab: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [fedora-all]
CVE-2026-65904 jupyterlab: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS
Bugzilla
CVE-2026-65904 DOMPurify: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms
bugzilla·2026-07-23·CVSS 4.7
CVE-2026-65904 [MEDIUM] CVE-2026-65904 DOMPurify: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms
CVE-2026-65904 DOMPurify: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact. The vendor considers this an edge case outside DOMPurify's threat model and, at time of publication, no fix was planned.
2026-07-23
Published