CVE-2026-49459

Analyzed Analyzed - Analysis Complete

DOM Clobbering Leads to XSS in DOMPurify

Publication date: 2026-07-14

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-21

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-49459

Affected Vendors & Products

Vendor	Product	Version / Range
cure53	dompurify	to 3.4.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

DOMPurify before 3.4.6 had a flaw where sanitize with IN_PLACE true could keep event-handler attributes on a malicious form element. This happened when a child element's name changed properties checked by _isClobbered, causing _forceRemove to skip removal and _sanitizeAttributes to exit early.

Detection Guidance

This vulnerability affects DOMPurify versions before 3.4.6. To detect it, check the installed version of DOMPurify in your environment. If you are using a vulnerable version, update to 3.4.6 or later immediately.

Impact Analysis

An attacker could inject malicious scripts via event handlers on a form element, leading to cross-site scripting (XSS) attacks. This may allow stealing user data, session hijacking, or defacing websites using affected DOMPurify versions.

Compliance Impact

This XSS vulnerability could expose user data, violating GDPR's data protection principles or HIPAA's security requirements for safeguarding health information. Organizations using vulnerable DOMPurify versions risk non-compliance and potential fines.

Mitigation Strategies

Update DOMPurify to version 3.4.6 or later to address the vulnerability. Review any code using DOMPurify.sanitize with IN_PLACE set to true to ensure proper sanitization of event-handler attributes.

Hi! I’m here to help you understand CVE-2026-49459. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70