CVE-2026-65904CWE-754

DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode

Low · published July 23, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
17.5
In the wild
Unconfirmed
What it is

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00266 · 17.5th percentile
Weakness
CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published
2026-07-23T13:16Z
EPSS history
Timeline
  • 23 JUL 13:16Z
    DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode
    cvelistv5