CVE-2026-65904

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-65904
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/cure53/DOMPurify/security/advisories/GHSA-4w3q-35jp-p934 Exploit Third Party Advisory
https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-mode Third Party Advisory
https://github.com/cure53/DOMPurify/security/advisories/GHSA-4w3q-35jp-p934 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*
History

28 Jul 2026, 15:51

Type Values Removed Values Added
CPE cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*
First Time Cure53 dompurify
Cure53
References () https://github.com/cure53/DOMPurify/security/advisories/GHSA-4w3q-35jp-p934 - () https://github.com/cure53/DOMPurify/security/advisories/GHSA-4w3q-35jp-p934 - Exploit, Third Party Advisory
References () https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-mode - () https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-mode - Third Party Advisory

24 Jul 2026, 22:16

Type Values Removed Values Added
Summary (en) DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact. The vendor considers this an edge case outside DOMPurify's threat model and, at time of publication, no fix was planned. (en) DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.

23 Jul 2026, 16:17

Type Values Removed Values Added
References () https://github.com/cure53/DOMPurify/security/advisories/GHSA-4w3q-35jp-p934 - () https://github.com/cure53/DOMPurify/security/advisories/GHSA-4w3q-35jp-p934 -

23 Jul 2026, 14:18

Type Values Removed Values Added
New CVE
Information

Published : 2026-07-23 14:18

Updated : 2026-07-28 15:51

NVD link : CVE-2026-65904

Mitre link : CVE-2026-65904

CVE.ORG link : CVE-2026-65904

JSON object : View

Products Affected

cure53

  • dompurify
CWE
CWE-754

Improper Check for Unusual or Exceptional Conditions