CVE-2026-65904
DOMPurify: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · July 23, 2026
Updated · October 27, 2026
Description
A flaw was found in DOMPurify. When DOM elements originating from a different window or realm, such as an iframe's contentDocument, are processed in IN_PLACE mode, DOMPurify fails to properly sanitize them. This oversight allows an attacker to inject and execute Cross-Site Scripting (XSS) payloads, potentially leading to information disclosure or other malicious actions within the user's browser session. Exploitation requires user interaction and has high attack complexity.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 4.7CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')