CVE-2026-65901

A flaw was found in DOMPurify. This cross-site scripting (XSS) vulnerability exists in IN_PLACE mode, where the software trusts attacker-controlled nodeName on live non-form nodes. A remote attacker can supply hostile live Document Object Model (DOM) objects with script children. These scripts can execute when the sanitized tree is inserted into a live document, potentially leading to information disclosure or arbitrary code execution.

This cross-site scripting (XSS) vulnerability in DOMPurify arises when the library is used with IN_PLACE: true on attacker-supplied live DOM nodes. An attacker can manipulate a script child node's nodeName to bypass sanitization, leading to arbitrary script execution when the sanitized tree is inserted into a live document. This impacts Red Hat products that process untrusted live DOM content using DOMPurify in this specific configuration.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.