PT-2026-63990 · Cure53 · Dompurify

Fg0X0 · CVE-2026-65904 · Published 2026-07-23 · Updated 2026-07-23

NVD

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact. The vendor considers this an edge case outside DOMPurify's threat model and, at time of publication, no fix was planned.

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2026-65904

Affected Products

Dompurify

References · 3

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-4w3q-35jp-p934 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-65904 · Security Note
• https://vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-mode · Note