CVE-2026-65901: DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in INPLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65901?
The severity of CVE-2026-65901 is classified as medium with a score of 6.1.
How does CVE-2026-65901 affect DOMPurify?
CVE-2026-65901 allows attackers to exploit a cross-site scripting vulnerability through manipulated live DOM objects in DOMPurify version 3.4.6.
How do I fix CVE-2026-65901?
To fix CVE-2026-65901, update DOMPurify to a version later than 3.4.6 that addresses this vulnerability.
What type of vulnerability is CVE-2026-65901?
CVE-2026-65901 is classified as a cross-site scripting (XSS) vulnerability.
What are the potential impacts of CVE-2026-65901?
CVE-2026-65901 can lead to unauthorized script execution in the context of the victim's browser, potentially compromising user data.