CVE-2026-49459
CVE-2026-49459 · DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
This page contains facts from public vulnerability sources. Check the original advisory before updating.
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.
CVSS 6.1 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Affected products and versions
dompurify
- Versions
- < 3.4.6: Affected
No fix published
node-dompurify Debian:12
- Versions
- 2.4.1+dfsg+~2.4.0-1
- 2.4.1+dfsg+~2.4.0-2
- 2.4.1+dfsg+~2.4.0-2+deb12u1
- 3.0.9+dfsg+~3.0.5-1
- 3.1.6+dfsg+~3.0.5-1
- 3.1.7+dfsg+~3.0.5-1
- 3.1.7+dfsg+~3.0.5-2
- 3.2.5+dfsg-1
- 3.3.2+dfsg-1
- 3.3.3+dfsg-1
- 3.3.3+dfsg-2
- 3.4.1+dfsg-1
- 3.4.12+dfsg-1
- 3.4.13+dfsg-1
- 3.4.13+dfsg-2
- 3.4.16+dfsg-1
- 3.4.2+dfsg-1
- 3.4.5+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-dompurify Debian:13
- Versions
- 3.1.7+dfsg+~3.0.5-2
- 3.2.5+dfsg-1
- 3.3.2+dfsg-1
- 3.3.3+dfsg-1
- 3.3.3+dfsg-2
- 3.4.1+dfsg-1
- 3.4.12+dfsg-1
- 3.4.13+dfsg-1
- 3.4.13+dfsg-2
- 3.4.16+dfsg-1
- 3.4.2+dfsg-1
- 3.4.5+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-dompurify Debian:14
- Versions
- 3.1.7+dfsg+~3.0.5-2
- 3.2.5+dfsg-1
- 3.3.2+dfsg-1
- 3.3.3+dfsg-1
- 3.3.3+dfsg-2
- 3.4.1+dfsg-1
- 3.4.2+dfsg-1
- 3.4.5+dfsg-1
- Affected ranges
- ECOSYSTEM: < 3.4.12+dfsg-1
Update to 3.4.12+dfsg-1
dompurify npm
- Affected ranges
- SEMVER: < 3.4.6
Update to 3.4.6
dompurify.js Ubuntu:16.04:LTS
- Versions
- 0.7.3~dfsg1-1
- 0.7.3~dfsg1-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dompurify.js Ubuntu:18.04:LTS
- Versions
- 0.9.0~dfsg1-1
- 0.9.0~dfsg1-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-dompurify Ubuntu:22.04:LTS
- Versions
- 2.3.0+dfsg-2
- 2.3.3+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-dompurify Ubuntu:24.04:LTS
- Versions
- 2.4.1+dfsg+~2.4.0-1
- 3.0.9+dfsg+~3.0.5-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-dompurify Ubuntu:26.10
- Versions
- 3.3.3+dfsg-1
- 3.4.2+dfsg-1
- 3.4.5+dfsg-1
- 3.4.12+dfsg-1
- 3.4.13+dfsg-1
- 3.4.13+dfsg-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-dompurify Ubuntu:26.04:LTS
- Versions
- 3.1.7+dfsg+~3.0.5-2
- 3.3.3+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published