CVE-2026-65904

Name of the Vulnerable Software and Affected Versions DOMPurify versions 3.0.0 through 3.3.3

Description When using the IN PLACE mode, the software fails to sanitize DOM elements that originate from a different window or realm, such as an iframe's contentDocument. This occurs because a cross-realm instanceof check within the isNode() function returns false for nodes from foreign realms. Consequently, the software stringifies the element, resets IN PLACE to false, and returns the original unsanitized element, allowing Cross-Site Scripting (XSS) payloads to remain intact.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.