PT-2026-49557

CVE-2026-49458

Published

2026-06-15

Updated

2026-09-25

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.4.6

Description DOMPurify fails to properly sanitize DOM nodes from same-origin foreign realms (such as those from an iframe, popup window, or opened tab) when using the DOMPurify.sanitize(node, { IN PLACE: true }) method. The issue occurs because the library uses realm-bound instanceof checks against parent-realm constructors. Since constructors are unique to each realm, these checks return false for foreign-realm nodes, causing the sanitizer to skip critical security branches.

Technical details include:

Clobbering Bypass: The isClobbered() function fails to recognize foreign-realm <form> elements, allowing attacker-controlled attributes like onmouseover or onclick to survive.
Template Bypass: The sanitizeShadowDOM() and main iterator fail to recognize DocumentFragment objects in the .content property of foreign-realm <template> elements, leaving executable markup inside the template.
Shadow DOM Bypass: The sanitizeAttachedShadowRoots() function fails to recognize foreign-realm ShadowRoot objects, skipping the sanitization of the entire shadow subtree.

This can lead to cross-site scripting (XSS) when the application later inserts or activates the sanitized node in the live DOM.

Recommendations Update DOMPurify to version 3.4.6. As a temporary workaround, avoid using the IN PLACE: true option when sanitizing DOM nodes created in a different realm than the DOMPurify instance.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-693: Protection Mechanism Failure

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

CWE-501: Trust Boundary Violation

Related identifiers

CVE-2026-49458