PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49458 cure53 CVE debrief

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches so executable markup could survive. This issue is fixed in version 3.4.6. Users of DOMPurify versions prior to 3.4.6 should update to the latest version to prevent potential cross-site scripting attacks. The vulnerability has a CVSS score of 6.1 and is considered medium severity.

Vendor
cure53
Product
DOMPurify
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-14
Original CVE updated
2026-07-21
Advisory published
2026-07-14
Advisory updated
2026-07-21

Who should care

Users of DOMPurify versions prior to 3.4.6, security teams, and operators of affected systems should be aware of this vulnerability and take steps to mitigate it. This includes updating to the latest version of DOMPurify, reviewing and updating affected systems or applications, and monitoring for potential cross-site scripting attacks.

Technical summary

The vulnerability in DOMPurify versions prior to 3.4.6 allows for cross-site scripting attacks due to improper sanitization of same-origin foreign-realm DOM nodes. The fix in version 3.4.6 ensures that instanceof checks are performed correctly, preventing executable markup from surviving sanitization. Affected systems or applications using DOMPurify should be reviewed and updated to prevent potential attacks.

Defensive priority

Medium priority given the CVSS score of 6.1 and the potential for cross-site scripting attacks.

Recommended defensive actions

  • Update DOMPurify to version 3.4.6 or later
  • Review and update any affected systems or applications using DOMPurify
  • Monitor for potential cross-site scripting attacks
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and the fix in version 3.4.6. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected deployments, review official advisories, and track exceptions. Additional information from other sources may be necessary for comprehensive risk assessment.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-49458 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-49458

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-49458 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-49458

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.