Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-49459— DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

CVSS 6.1 · Medium EPSS 0.30% · P23

Possible ATT&CK Techniques 1AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 1

VendorProductVersion RangeStatus
cure53DOMPurify< 3.4.6affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-49459

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
Source: CVE Program / CVE List V5
Vulnerability Description
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Cure53 DOMPurify 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cure53 DOMPurify是Cure53公司开源的一款使用JavaScript编写的,用于HTML、MathML和SVG的DOM(文档对象模型)。 Cure53 DOMPurify 3.4.6之前版本存在安全漏洞，该漏洞源于DOMPurify.sanitize(root, { IN_PLACE: true })在处理攻击者控制的<form>根元素时，会因属性名覆盖检查问题保留事件处理属性，可能遭受跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
cure53DOMPurify < 3.4.6 -

II. Public POCs for CVE-2026-49459

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-49459

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-49459 (1)

Vendor Pages for CVE-2026-49459 (1)

Same Patch Batch · cure53 · 2026-07-14 · 4 CVEs total

CVE-2026-474238.2 HIGHDOMPurify XSS via `selectedcontent` re-clone
CVE-2026-494586.1 MEDIUMDOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bou
CVE-2026-49978DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

IV. Related Vulnerabilities

Same product: DOMPurify
Same vendor: cure53
Same weakness: CWE-79

V. Comments for CVE-2026-49459

No comments yet

Leave a comment