CVE-2026-65901 in DOMPurify
Summary
by MITRE • 07/23/2026
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/23/2026
DOMPurify versions through 3.4.6 contain a critical cross-site scripting vulnerability that arises from improper handling of attacker-controlled nodeName attributes in IN_PLACE mode. This vulnerability specifically affects live non-form DOM nodes where the sanitization process incorrectly trusts malicious nodeName values, allowing attackers to craft hostile DOM objects with legitimate script children that appear as allowed elements due to clobbered nodeName properties. The flaw operates at the core of DOMPurify's sanitization logic where it fails to properly validate or sanitize node names in live document contexts, creating a pathway for persistent cross-site scripting attacks.
The technical exploitation occurs when attackers construct malicious DOM objects with script children whose nodeName properties are manipulated to match allowed element patterns during sanitization. This clobbering technique allows the sanitizer to incorrectly classify these dangerous nodes as safe, subsequently executing embedded scripts when the sanitized tree is inserted back into a live document context. The vulnerability specifically targets IN_PLACE mode which processes existing DOM structures rather than creating new ones from scratch, making it particularly dangerous for applications that modify existing content dynamically.
From an operational impact perspective, this vulnerability enables attackers to bypass DOMPurify's security controls and execute arbitrary scripts within the victim's browser context, potentially leading to session hijacking, data theft, or full system compromise. The attack requires minimal privileges since it exploits the sanitization process itself rather than requiring additional access vectors. This makes it particularly dangerous for web applications that rely on DOMPurify for content sanitization and user-generated content handling.
The vulnerability aligns with CWE-79 Cross-site Scripting and follows ATT&CK technique T1203 Exploitation for Client Execution, where attackers leverage application vulnerabilities to execute malicious code in user browsers. Organizations using DOMPurify in IN_PLACE mode should immediately upgrade to version 3.4.7 or later which addresses this specific flaw through enhanced nodeName validation and proper sanitization of live DOM structures. Additional mitigations include implementing Content Security Policy headers, regular security audits of DOM manipulation code, and thorough input validation beyond just DOMPurify's built-in protections.
Security researchers have identified that this vulnerability represents a fundamental flaw in how DOMPurify handles dynamic node validation during IN_PLACE operations, where the trust model between the sanitizer and live DOM elements creates an attack surface for malicious input manipulation. The fix implemented in newer versions ensures proper node name verification regardless of whether nodes are part of static or dynamic content, preventing the clobbering attack pattern that previously enabled script execution. Organizations should conduct immediate assessment of their DOMPurify usage patterns to identify any applications operating in IN_PLACE mode that might be vulnerable to this specific class of cross-site scripting attacks.