Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-49458— DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

CVSS 6.1 · Medium EPSS 0.38% · P32

Possible ATT&CK Techniques 1AI

T1059.013 · Container CLI/API

Affected Version Matrix 1

VendorProductVersion RangeStatus
cure53DOMPurify< 3.4.6affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-49458

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
Source: CVE Program / CVE List V5
Vulnerability Description
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches so executable markup could survive. This issue is fixed in version 3.4.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Cure53 DOMPurify 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cure53 DOMPurify是Cure53公司开源的一款使用JavaScript编写的,用于HTML、MathML和SVG的DOM(文档对象模型)。 Cure53 DOMPurify 3.4.6之前版本存在安全漏洞，该漏洞源于接受同源非同域DOM节点且跟随检查使用父域构造函数，导致表单、命名节点映射、文档片段和元素的instanceof检查失败并跳过清理分支，导致可执行标记可能保留。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
cure53DOMPurify < 3.4.6 -

II. Public POCs for CVE-2026-49458

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-49458

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-49458 (1)

Vendor Pages for CVE-2026-49458 (1)

Same Patch Batch · cure53 · 2026-07-14 · 4 CVEs total

CVE-2026-474238.2 HIGHDOMPurify XSS via `selectedcontent` re-clone
CVE-2026-494596.1 MEDIUMDOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS vi
CVE-2026-49978DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

IV. Related Vulnerabilities

Same product: DOMPurify
Same vendor: cure53
Same weakness: CWE-79

V. Comments for CVE-2026-49458

No comments yet

Leave a comment