CVE-2026-49459 Details
Description
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.
A vulnerability in DOMPurify versions through 3.4.5 allows for cross-site scripting (XSS) attacks when using the IN_PLACE sanitization mode. This issue arises because event-handler attributes on an attacker-controlled <form> element can be preserved. The vulnerability occurs when a descendant element's name clobbers properties that are checked by DOMPurify's clobbering detection, leading to a failure in proper attribute sanitization. The root cause lies in the way DOMPurify handles clobbered nodes in IN_PLACE mode, particularly with forms, which can unintentionally allow malicious scripts to execute.
Users can upgrade to DOMPurify version 3.4.6 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cure53/DOMPurify/security/advisories/GHSA-r47g-fvhr-h676 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/cure53/DOMPurify/commit/bb7739e5bccec7e1ab3dae3f3e42d02db3acaaae | [email protected] | Patch |
| https://github.com/cure53/DOMPurify/releases/tag/3.4.6 | [email protected] | Release Notes |
| https://github.com/cure53/DOMPurify/security/advisories/GHSA-r47g-fvhr-h676 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
| CWE-693 | Protection Mechanism Failure | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cure53 dompurify | < 3.4.6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | Initial Analysis | [email protected] |
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |