PT-2026-49557 · Root+5 · @Rootio/Dompurify+3
CVE-2026-49458
·
Published
2026-06-15
·
Updated
2026-08-31
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
DOMPurify versions prior to 3.4.6
Description
DOMPurify fails to properly sanitize DOM nodes from same-origin foreign realms (such as those from an iframe, popup window, or opened tab) when using the
DOMPurify.sanitize(node, { IN PLACE: true }) method. The issue occurs because the library uses realm-bound instanceof checks against parent-realm constructors. Since constructors are unique to each realm, these checks return false for foreign-realm nodes, causing the sanitizer to skip critical security branches.Technical details include:
- Clobbering Bypass: The
isClobbered()function fails to recognize foreign-realm<form>elements, allowing attacker-controlled attributes likeonmouseoveroronclickto survive. - Template Bypass: The
sanitizeShadowDOM()and main iterator fail to recognizeDocumentFragmentobjects in the.contentproperty of foreign-realm<template>elements, leaving executable markup inside the template. - Shadow DOM Bypass: The
sanitizeAttachedShadowRoots()function fails to recognize foreign-realmShadowRootobjects, skipping the sanitization of the entire shadow subtree.
This can lead to cross-site scripting (XSS) when the application later inserts or activates the sanitized node in the live DOM.
Recommendations
Update DOMPurify to version 3.4.6.
As a temporary workaround, avoid using the
IN PLACE: true option when sanitizing DOM nodes created in a different realm than the DOMPurify instance.Exploit
Fix
Protection Mechanism Failure
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
@Rootio/Dompurify
Dompurify
Dompurify.Js
Node-Dompurify