Description
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| cure53 | DOMPurify | ≤ 3.4.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-dompurify | 3.4.12+dfsg-1 | — |
| Debian 13 | node-dompurify | No fix yet | — |
| Debian 12 | node-dompurify | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-dompurify | No fix yet | — |
| Ubuntu 26.04 LTS | node-dompurify | No fix yet | — |
| Ubuntu 24.04 LTS | node-dompurify | No fix yet | — |
| Ubuntu 22.04 LTS | node-dompurify | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.8-0.1.2.hum1 | RHSA-2026:58500 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.3-0.1.3.hum1 | RHSA-2026:58502 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | langfuse-3-compat | 3.225.7-r6 | — |
| Wolfi rolling | langfuse-3-worker | 3.191.0-r0 | — |
| Wolfi rolling | nextcloud-server-33 | 33.0.6-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | dompurify | <= 3.4.6 | — | GHSA-x4vx-rjvf-j5p4 |
Advisories 2
- RHSA-2026:58502 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:58500 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
References
- GitHub Security Advisory (GHSA-x4vx-rjvf-j5p4) vendor-advisory
- VulnCheck Advisory: DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName third-party-advisory