{"id":"CVE-2026-65904","aliases":["DEBIAN-CVE-2026-65904","EUVD-2026-48273","GHSA-4w3q-35jp-p934","RHSA-2026:54517","UBUNTU-CVE-2026-65904"],"status":"published","title":"DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode","description":"DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.","severity":{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00266,"percentile":0.18629,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-754"],"published":"2026-07-23T13:16:22Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"Debian:14","package":"node-dompurify","fixed_in":["3.4.5+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1+dfsg+~2.4.0-1","2.4.1+dfsg+~2.4.0-2","2.4.1+dfsg+~2.4.0-2+deb12u1","3.0.9+dfsg+~3.0.5-1","3.1.6+dfsg+~3.0.5-1","3.1.7+dfsg+~3.0.5-1","3.1.7+dfsg+~3.0.5-2","3.2.5+dfsg-1","3.3.2+dfsg-1","3.3.3+dfsg-1","3.3.3+dfsg-2","3.4.1+dfsg-1","3.4.12+dfsg-1","3.4.13+dfsg-1","3.4.13+dfsg-2","3.4.16+dfsg-1","3.4.2+dfsg-1","3.4.5+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.7+dfsg+~3.0.5-2","3.2.5+dfsg-1","3.3.2+dfsg-1","3.3.3+dfsg-1","3.3.3+dfsg-2","3.4.1+dfsg-1","3.4.12+dfsg-1","3.4.13+dfsg-1","3.4.13+dfsg-2","3.4.16+dfsg-1","3.4.2+dfsg-1","3.4.5+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5+dfsg-1"}]}],"versions":["3.1.7+dfsg+~3.0.5-2","3.2.5+dfsg-1","3.3.2+dfsg-1","3.3.3+dfsg-1","3.3.3+dfsg-2","3.4.1+dfsg-1","3.4.2+dfsg-1"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.3-0.1.1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0+dfsg-2","2.3.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1+dfsg+~2.4.0-1","3.0.9+dfsg+~3.0.5-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.7+dfsg+~3.0.5-2","3.3.3+dfsg-1"]}],"products":[{"vendor":"cure53","product":"dompurify"}],"references":[{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-4w3q-35jp-p934","tags":["vendor-advisory","exploit","Exploit","Third Party Advisory","advisory","article","report"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-mode","tags":["third-party-advisory","Third Party Advisory","advisory","article"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65904.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65904","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-65904","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54517","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73088","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73089","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45819","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16221","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65904","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65912","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65911","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65914","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65913","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54517.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2502307","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16221","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515240","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45819","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45819","tags":["advisory"]},{"url":"https://github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts#L142","tags":["article"]},{"url":"https://github.com/web-platform-dx/baseline-browser-mapping/pull/137/changes#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519","tags":["article"]},{"url":"https://www.npmjs.com/package/baseline-browser-mapping","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506426","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65904","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506434","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65911","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65911","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-9p3w-6h5p-cv75","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-xss-via-add-attr-add-tags-state-leakage","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506427","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65912","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65912","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cjmm-f4jc-qw8r","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-uri-validation-bypass-via-add-attr","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506429","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65913","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65913","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cj63-jhhr-wcxv","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-prototype-pollution-via-use-profiles","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506430","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65914","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65914","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-h8r8-wccr-v5f2","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-mutation-xss-via-re-contextualization","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514177","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73088","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73088","tags":["advisory"]},{"url":"https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","tags":["article"]},{"url":"https://github.com/browserslist/browserslist/releases/tag/4.28.7","tags":["article"]},{"url":"https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73089","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73089","tags":["advisory"]},{"url":"https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","tags":["article"]},{"url":"https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-65904","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-65904","title":"DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode","description":"DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.","status":"published","published":"2026-07-23T13:16:22.069Z","modified":"2026-07-24T21:35:25.747Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"low","assessor":"cna"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T13:37:13.934727Z"}],"euvd":[{"id":"EUVD-2026-48273","description":"DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.","status":"published","published":"2026-07-23T13:16:22Z","modified":"2026-07-24T21:35:25Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"low"}],"updated_at":"2026-11-02T18:19:38.612768Z"}],"nvd":[{"id":"CVE-2026-65904","description":"DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.","status":"published","published":"2026-07-23T14:18:06.063Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:12:32.473901Z"}],"osv":[{"id":"CVE-2026-65904","title":"DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode","description":"DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.","status":"published","published":"2026-07-23T13:16:22.069Z","modified":"2026-10-28T02:30:33.122430242Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"low"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T15:45:14.46177Z"},{"id":"DEBIAN-CVE-2026-65904","description":"DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.","status":"published","published":"2026-07-23T14:18:06.063Z","modified":"2026-10-25T09:47:33.363426352Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"updated_at":"2026-11-02T15:45:58.699079Z"},{"id":"RHSA-2026:54517","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-13T10:17:50Z","modified":"2026-10-20T10:11:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"UBUNTU-CVE-2026-65904","description":"DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.","status":"published","published":"2026-07-23T14:18:00Z","modified":"2026-07-29T10:18:57.298818151Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"low"}],"updated_at":"2026-11-02T16:56:53.710209Z"}]}}