SEPTEMBER 11, 2026
Live Feed
Back to database
Case File

CVE-2026-65904

MEDIUM · CVSS 4.7 EPSS 0.17% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-23 · Last synced 2026-08-22

CyberRota Analysis

AI-Generated

DOMPurify versions up to 3.3.3 are vulnerable when processing DOM elements in IN_PLACE mode from different windows or realms, such as iframes, leading to inadequate sanitization of potentially malicious content. This flaw allows attackers to inject XSS payloads into applications that rely on DOMPurify for sanitizing user-generated content. Developers and security teams using DOMPurify in environments where cross-origin elements are handled should prioritize remediation to mitigate the risk of XSS attacks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-65904
Severity
MEDIUM
CVSS
4.7
EPSS
0.17%

Original NVD Description

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.

Related CVEs

Other vulnerabilities affecting the same vendor(s)