CVE-2026-65904 Details
Description
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.
A cross-site scripting (XSS) vulnerability has been identified in DOMPurify versions through 3.3.3. The issue arises in IN_PLACE mode when DOM elements from a different window or realm, such as an iframe's contentDocument, are not properly sanitized. This failure is due to a cross-realm instanceof check in the private _isNode() function, which incorrectly identifies foreign-realm nodes. As a result, DOMPurify stringifies the element, resets IN_PLACE to false, and returns the unsanitized element with any XSS payloads intact. The vendor considers this an edge case outside of DOMPurify's threat model and has no plans for a fix at this time.
Users are advised to update DOMPurify to version 3.4.4 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cure53/DOMPurify/security/advisories/GHSA-4w3q-35jp-p934 | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/cure53/DOMPurify/security/advisories/GHSA-4w3q-35jp-p934 | [email protected] | ExploitThird Party Advisory |
| https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-mode | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-754 | Improper Check for Unusual or Exceptional Conditions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cure53 dompurify | < 3.4.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | Initial Analysis | [email protected] |
| Jul 24, 2026 | CVE Modified | [email protected] |
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 23, 2026 | New CVE Received | [email protected] |