Executive brief
DOMPurify is a popular library used to clean and sanitize HTML to prevent malicious code from running in web browsers. A vulnerability exists where the library fails to properly inspect certain types of live web elements when running in a specific 'in-place' mode. This could allow an attacker to bypass security filters and execute malicious scripts (Cross-Site Scripting) in a user's browser, potentially leading to unauthorized actions or data theft.
Technical details
A cross-site scripting (XSS) vulnerability exists in DOMPurify through version 3.4.6 when using the `IN_PLACE: true` configuration. The root cause is that the `_sanitizeElements` function trusts the `nodeName` property of live non-form nodes without verifying it against the trusted prototype getter. An attacker can provide a hostile live DOM object (e.g., from a same-origin iframe or popup) where a `<script>` element's `nodeName` is clobbered to appear as an allowed element like `<div>`. Because the library's clobbering protection was previously scoped only to `<form>` elements, the malicious script is retained during sanitization and executes when the tree is inserted into the document. This bypass affects live node references but does not affect string-based sanitization.
Affected products
- cure53 DOMPurify <= 3.4.6
Timeline
- 2026-05-27: advisory: GitHub Security Advisory published by cure53
- 2026-07-23: disclosed: CVE-2026-65901 published