CVE-2026-49458

Analyzed Analyzed - Analysis Complete

DOM Clobbering Bypass in DOMPurify

Publication date: 2026-07-14

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches so executable markup could survive. This issue is fixed in version 3.4.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-21

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-49458

Affected Vendors & Products

Vendor	Product	Version / Range
cure53	dompurify	to 3.4.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
CWE-501	The product mixes trusted and untrusted data in the same data structure or structured message.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

DOMPurify before 3.4.6 has a flaw where sanitize with IN_PLACE set to true incorrectly handles same-origin foreign-realm DOM nodes. Instanceof checks for forms, named node maps, document fragments, and elements fail, skipping sanitization branches for clobber, template-content, and shadow-DOM. This allows executable markup to remain unsanitized.

Detection Guidance

This vulnerability affects DOMPurify versions prior to 3.4.6. To detect it, check the installed version of DOMPurify in your environment. If you are using a package manager like npm, run commands such as 'npm list dompurify' or 'npm list dompurify@version' to verify the installed version.

Impact Analysis

This vulnerability could allow malicious scripts to bypass XSS protections in applications using affected DOMPurify versions. Attackers might inject and execute harmful code in user browsers, leading to data theft, session hijacking, or defacement of trusted websites.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations using vulnerable DOMPurify versions may fail compliance audits.

Mitigation Strategies

Update DOMPurify to version 3.4.6 or later to address the issue with same-origin foreign-realm DOM nodes and failed sanitization checks.

Hi! I’m here to help you understand CVE-2026-49458. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70