PT-2026-42767 · Dompurify · Dompurify

CVE-2026-47423 · Published 2026-05-22 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions DOMPurify version 3.4.4

Description DOMPurify allows the <selectedcontent> element by default, which enables a bypass of the sanitization process. This occurs because browsers may re-clone an XSS payload after the sanitizer has already processed the subtree. Specifically, the browser creates a <selectedcontent> clone from a selected <option>; while DOMPurify sanitizes the clone and the original <option>, the browser subsequently refreshes the clone from the original content. Since this refreshed clone resides in a subtree already traversed by DOMPurify, it remains unsanitized, allowing the execution of malicious scripts when the resulting string is inserted into the page via methods such as innerHTML.

Recommendations As a temporary workaround, consider restricting the use of the <selectedcontent> element in the sanitizer configuration until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-47423

GHSA-87XG-PXX2-7HVX

RHSA-2026:10999

Affected Products

Dompurify

References · 17

• 🔥 https://github.com/cure53/DOMPurify/security/advisories/GHSA-87xg-pxx2-7hvx · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47423.json · Exploit
• https://github.com/cure53/DOMPurify/commit/011b0c78f2a0f57ee54f5fcccb697a46ca6e63ea · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-47423 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47423 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-47423 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-47423 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-47423 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-87xg-pxx2-7hvx · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-47423 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-47423 · Vendor Advisory
• https://github.com/cure53/DOMPurify/releases/tag/3.4.5 · Note
• https://github.com/cure53/DOMPurify · Note
• https://t.me/cveNotify/209961 · Telegram Post
• https://twitter.com/Kabir4charya/status/2057744820538581002 · Twitter Post