CVE-2026-49459 cure53 CVE debrief

Who should care

Users of DOMPurify versions prior to 3.4.6 should update to the latest version to prevent potential cross-site scripting attacks. Affected operators, platforms, vulnerability-management, and security teams should review the CVE record and NVD entry for details on the vulnerability and the fix in version 3.4.6.

Technical summary

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6. The fix involves updating DOMPurify to version 3.4.6 or later, reviewing and updating any affected systems or applications using DOMPurify, and monitoring for potential cross-site scripting attacks.

Defensive priority

Medium priority due to the CVSS score of 6.1 and the potential for cross-site scripting attacks.

Recommended defensive actions

• Update DOMPurify to version 3.4.6 or later
• Review and update any affected systems or applications using DOMPurify
• Monitor for potential cross-site scripting attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and the fix in version 3.4.6. Evidence limits suggest that DOMPurify versions prior to 3.4.6 are potentially vulnerable to cross-site scripting attacks. Defenders should verify the affected scope and severity, review compensating controls, and track exceptions. The CVE record was published on 2026-07-14T21:17:01.743Z and has not been modified since then.

Official resources