CVE-2026-47423

Analyzed Analyzed - Analysis Complete

DOM Clobbering via Selectedcontent in DOMPurify

Publication date: 2026-07-14

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an XSS payload after sanitization so that unsanitized markup inside <selectedcontent> is returned. This issue is fixed in version 3.4.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-21

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-47423

Affected Vendors & Products

Vendor	Product	Version / Range
cure53	dompurify	3.4.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

DOMPurify 3.4.4 allowed a new HTML element called selectedcontent by default. This element could cause browsers to re-clone XSS payloads after sanitization, reintroducing unsanitized malicious markup into the DOM. The vulnerability was fixed in version 3.4.5.

Detection Guidance

Check if your system uses DOMPurify version 3.4.4 by inspecting package.json or installed modules. Look for the presence of selectedcontent elements in sanitized HTML inputs. Use browser developer tools to inspect DOM elements for unsanitized payloads after sanitization.

Impact Analysis

An attacker could craft malicious HTML input containing XSS payloads that bypass DOMPurify's sanitization. When inserted into a page via methods like innerHTML, the payload could execute in the user's browser, potentially stealing data, session cookies, or performing actions on their behalf.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information, risking compliance with security requirements for ePHI.

Mitigation Strategies

Upgrade DOMPurify to version 3.4.5 or later immediately. Review and sanitize all HTML inputs using trusted libraries. Monitor for unusual XSS activity in web applications. Remove any selectedcontent elements from user-controlled inputs.

Hi! I’m here to help you understand CVE-2026-47423. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70