CVE-2026-49458: cure53 DOMPurify XSS via cross-realm bypass in IN_PLACE mode

CVE-2026-49458 · Severity: medium · CVSS 6.1 · Published 2026-07-14

DOMPurify, a popular library used to clean and sanitize web content to prevent security attacks, contains a flaw when processing content in a specific "in-place" mode. This vulnerability allows malicious code to bypass security filters if the content is handled across different parts of a web application (such as between an iframe and the main page). If exploited, an attacker could execute unauthorized scripts in a user's browser, potentially leading to data theft or account takeover.

Technologies: dompurify (npm). Vendors: npm.

Quick answers

Is CVE-2026-49458 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49458 being exploited in the wild.
How severe is CVE-2026-49458?
Medium severity, with a CVSS score of 6.1, published 14 July 2026.
Which products and versions are affected?
dompurify (npm) <= 3.4.5, SEMVER:introduced=0,fixed=3.4.6.
Is there a fix for CVE-2026-49458?
Yes. dompurify (npm): upgrade to 3.4.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49458 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-49458?
Check whether you run dompurify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • dompurify (npm): upgrade to 3.4.6 or later
    npm install dompurify@3.4.6

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in DOMPurify when using `DOMPurify.sanitize(node, { IN_PLACE: true })`. The root cause is a trust boundary violation where the library accepts same-origin foreign-realm DOM nodes (e.g., from an iframe) but performs security checks using `instanceof` against parent-realm constructors. Because constructors are realm-specific, checks for `HTMLFormElement`, `NamedNodeMap`, and `DocumentFragment` fail for foreign-realm nodes. This causes the sanitizer to skip critical branches for DOM clobbering protection, template content sanitization, and Shadow DOM inspection. An attacker can provide malicious markup that survives the sanitization process and executes when the node is later activated or inserted into the main document. This issue is fixed in version 3.4.6 by hardening cross-realm checks.

Affected products

  • cure53 DOMPurify < 3.4.6

Identifiers

  • CVE-2026-49458
  • GHSA-hpcv-96wg-7vj8

Timeline

  • 2026-05-26: patched: Version 3.4.6 released
  • 2026-07-14: advisory: GitHub Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.