CVE-2026-65904: DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset INPLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65904?
The severity of CVE-2026-65904 is rated as medium with a score of 4.7.
What type of vulnerability is identified in CVE-2026-65904?
CVE-2026-65904 is a Cross-Site Scripting (XSS) vulnerability.
How do I fix CVE-2026-65904?
To fix CVE-2026-65904, update DOMPurify to version 3.4.4 or later.
What is the impact of CVE-2026-65904?
CVE-2026-65904 can lead to XSS attacks when using IN_PLACE mode with content from a different window or realm.
Which versions of DOMPurify are affected by CVE-2026-65904?
Versions of DOMPurify earlier than 3.4.4 are affected by CVE-2026-65904.