CVE-2026-49459

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.4.6

Description When using DOMPurify.sanitize(root, { IN PLACE: true }) with a <form> element as the root, an attacker can bypass attribute sanitization. This occurs if a descendant element has a name attribute that clobbers properties checked by the isClobbered() function (such as nodeName, setAttribute, namespaceURI, insertBefore, hasChildNodes, childNodes, attributes, textContent, removeChild, or removeAttribute).

The bypass happens because the forceRemove() function fails to remove the root node when it has no parent, and the sanitizeAttributes() function early-returns when it detects a clobbered node, assuming it has already been removed. This allows event-handler attributes (e.g., onmouseover, onclick), javascript: URIs in action or formaction attributes, and DOM-clobbering id attributes to persist on the root element. Additionally, this bypass affects the SAFE FOR TEMPLATES configuration, allowing raw template syntax to survive in the root's attributes.

Recommendations Update DOMPurify to version 3.4.6 or later. As a temporary workaround, avoid using the IN PLACE: true option when the root node is constructed from untrusted HTML.