CVE-2026-65901 cure53 CVE debrief

Who should care

Developers and administrators using DOMPurify versions up to 3.4.6 should be aware of this vulnerability and take necessary precautions to prevent exploitation. They should review and update sanitization rules to prevent script execution and consider upgrading to DOMPurify version 3.4.7 or later. Additionally, operators, platforms, and security teams should be aware of the potential impact of this vulnerability on their systems and take steps to mitigate it. This includes verifying the presence of affected systems, assessing the potential operational impact, and implementing compensating controls as needed. Vulnerability management and security teams should prioritize this vulnerability based on its CVSS score of 5.1 and the potential for attackers to supply hostile live DOM objects. They should also monitor for and restrict hostile live DOM objects with real script children and review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. Asset inventory and change management processes should be reviewed to ensure that affected systems are identified and remediated promptly. Rollback and change window processes should be evaluated to minimize the impact of potential exploits. Source tracking and monitoring should be implemented to detect and respond to potential attacks. Compensating controls, such as monitoring and detection, should be implemented to identify and mitigate potential attacks. Exposure review and vendor patch guidance should be sought to ensure that affected systems are properly patched or mitigated. The vulnerability management process should be reviewed to ensure that similar vulnerabilities are identified and addressed promptly. The security team should review the sanitization rules and update them to prevent script execution. The security team should also review the compensating controls and implement them as needed. The asset inventory should be reviewed to identify affected systems and prioritize remediation. The change management process should be reviewed to ensure that patches are applied promptly. The monitoring and detection process should be reviewed to ensure that potential attacks are detecte

Technical summary

The vulnerability exists in DOMPurify through 3.4.6 in IN_PLACE mode, where it trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document. This vulnerability can be mitigated by implementing compensating controls to monitor and restrict live DOM object modifications.

Defensive priority

Medium-priority defensive actions are recommended due to the CVSS score of 5.1 and the potential for attackers to supply hostile live DOM objects.

Recommended defensive actions

• Inventory and verify DOMPurify versions up to 3.4.6 for potential exposure
• Implement compensating controls to monitor and restrict live DOM object modifications
• Consider upgrading to DOMPurify version 3.4.7 or later
• Monitor for and restrict hostile live DOM objects with real script children
• Review and update sanitization rules to prevent script execution

Evidence notes

The vulnerability exists in DOMPurify through 3.4.6 in IN_PLACE mode, where it trusts attacker-controlled nodeName on live non-form nodes. Limited evidence is available about the scope of affected systems and potential workarounds. Further verification is needed to determine the extent of the vulnerability and to identify potential mitigations. Defenders should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance.

Official resources