CVE-2026-49458 cure53 CVE debrief

Who should care

Users of DOMPurify versions prior to 3.4.6, security teams, and operators of affected systems should be aware of this vulnerability and take steps to mitigate it. This includes updating to the latest version of DOMPurify, reviewing and updating affected systems or applications, and monitoring for potential cross-site scripting attacks.

Technical summary

The vulnerability in DOMPurify versions prior to 3.4.6 allows for cross-site scripting attacks due to improper sanitization of same-origin foreign-realm DOM nodes. The fix in version 3.4.6 ensures that instanceof checks are performed correctly, preventing executable markup from surviving sanitization. Affected systems or applications using DOMPurify should be reviewed and updated to prevent potential attacks.

Defensive priority

Medium priority given the CVSS score of 6.1 and the potential for cross-site scripting attacks.

Recommended defensive actions

• Update DOMPurify to version 3.4.6 or later
• Review and update any affected systems or applications using DOMPurify
• Monitor for potential cross-site scripting attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and the fix in version 3.4.6. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected deployments, review official advisories, and track exceptions. Additional information from other sources may be necessary for comprehensive risk assessment.

Official resources