CVE-2026-65904 DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode

Low 2.3 Published 23 Jul 2026 Updated 24 Jul 2026

DOMPurify fails to sanitize cross-realm DOM elements in IN_PLACE mode, allowing attackers to inject XSS payloads.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-65904?

CVE-2026-65904 is a low-severity cross-site scripting vulnerability in cure53 DOMPurify, published on 23 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.

Weakness: CWE-754

Which versions are affected by CVE-2026-65904?

It affects 1 product.

Products include Cure53 Dompurify.

How do I fix CVE-2026-65904?

Upgrade to a fixed version.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-65904 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-65904 exists.

Sources

Also known as DEBIAN-CVE-2026-65904, GHSA-4w3q-35jp-p934, UBUNTU-CVE-2026-65904.