What’s Vulnerable › Vulnerabilities

CVE-2026-65904: DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode

• Severity: medium (CVSS 4.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-07-23 · updated 2026-10-24
• Weakness: CWE-754

Description

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.

Affected products

• cure53 DOMPurify: before 3.4.4 — fixed in 3.4.4

How to fix

Upgrade to a fixed version: cure53 DOMPurify 3.4.4. Check the vendor advisory for mitigations.

References

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-4w3q-35jp-p934
• https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-mode
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-4w3q-35jp-p934

Get alerted when CVE-2026-65904 or the next vulnerability affects your stack