CVE-2026-65901
Undergoing Analysis Undergoing Analysis - In Progress

DOM Clobbering XSS in DOMPurify via Malicious NodeName

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-65901
EUVD
EUVD-2026-48270

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cure53 dompurify to 3.4.6 (inc)
dompurify dompurify to 3.4.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in DOMPurify versions 3.4.6 and earlier. It occurs in the IN_PLACE sanitization mode when the library incorrectly trusts attacker-controlled nodeName values on live non-form DOM nodes. Attackers can manipulate nodeName to make malicious script elements appear as safe tags, bypassing sanitization and executing scripts when the sanitized tree is inserted into a live document.

Detection Guidance

Detecting this vulnerability requires checking if your system uses DOMPurify version 3.4.6 or earlier in IN_PLACE mode. Inspect your application's dependencies for DOMPurify and verify the version. If using npm, run: npm list dompurify. Check for usage of IN_PLACE mode in your codebase. Monitor network traffic for unusual script executions or DOM manipulations.

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in a user's browser when sanitized content is inserted into a live document. This could lead to theft of session cookies, account takeovers, or unauthorized actions on behalf of the user. It primarily affects applications using DOMPurify's IN_PLACE mode with live DOM nodes.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information. Organizations using affected DOMPurify versions may face compliance risks if user data is compromised through such attacks.

Mitigation Strategies

Upgrade DOMPurify to a version newer than 3.4.6. Avoid using IN_PLACE mode if possible. If IN_PLACE is required, implement additional validation to check actual node types instead of relying on nodeName. Review and sanitize all DOM nodes from untrusted sources before insertion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65901. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart