CVE-2026-49458: cure53 dompurify Cross-site Scripting
CVSS: 6.1v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2026-49458DEBIAN-CVE-2026-49458CGA-5ffg-xgmc-x8xfCGA-67vj-3p93-fr64CGA-6ghh-j76c-mpxfCGA-8wxx-j8x4-fjwcCGA-gh85-qjwq-fpm6CGA-gj5c-qfhm-xq4qCGA-rjj4-g8m5-9xrmCGA-vqrj-rwwc-f6wmCGA-vxx9-3qxv-pr55GHSA-hpcv-96wg-7vj8CGA-2576-jr78-rwxhCGA-25ch-2h4x-phwvCGA-279q-fmq3-832fCGA-29cq-qcvg-jvxcCGA-2cf5-mpph-jq82CGA-2vg7-m754-76phCGA-343m-74pm-x6rgCGA-3g93-7w9v-p864CGA-3g9c-v5vp-53fhCGA-3vqw-m4r8-v5hmCGA-42h2-qf7f-q2cvCGA-47g9-75r6-r3mxCGA-47p8-w42f-v2r6CGA-489w-g8p3-fvpmCGA-4jhw-8vj9-fjcpCGA-4m4q-vmx4-8pgqCGA-4qp5-p4pm-95hcCGA-568c-v53c-jwr5CGA-5gqx-mrv9-q8q4CGA-5m24-5789-4jm7CGA-5m27-2656-fghwCGA-5vqx-8c97-x54wCGA-6332-h4j7-4hf5CGA-677g-3jpx-qqxmCGA-683h-cjr2-j5gcCGA-695v-g9cm-q88mCGA-6g7g-vv6v-wppcCGA-6q34-hqwg-mqfxCGA-6q6j-8642-q9j3CGA-794g-72wf-p6g8CGA-7cm4-47p8-q649CGA-7j68-26v5-fc3gCGA-7jjh-92vw-m4j4CGA-8346-9cxf-xv98CGA-83xv-9h7x-8365CGA-85h9-m6hj-hg3gCGA-87j9-fx6v-ch32CGA-8853-rhh5-f33gCGA-8cpj-25jv-g7fjCGA-8fj7-qp3g-fxq2CGA-8pwh-rhpf-mr2gCGA-8rpm-j4r3-656rCGA-8vhv-x5jf-xfgxCGA-92hm-p62v-8j4jCGA-945v-398c-g67hCGA-94m3-67q4-g6wmCGA-9h7j-4gcw-fcmqCGA-9p45-q5mj-2f9rCGA-9q4v-w54f-hx38CGA-9xv6-3hvv-3mr6CGA-cch4-44cm-vpwjCGA-cq4x-63cc-hmj6CGA-cr2r-qc8p-93f6CGA-f2jp-gf26-r2wvCGA-f765-8v2q-5575CGA-fc4x-vh33-65wqCGA-fwcx-2jmm-xq9mCGA-g88w-c2mh-qg5jCGA-gc2p-3rjm-cw9rCGA-gcx4-xxrv-939hCGA-gpc2-m9j9-c34rCGA-gqgp-v9hq-9j3qCGA-gwqg-ffw2-jj3hCGA-gxmc-ch5p-c5jcCGA-gxxw-fccc-xqj5CGA-hfm9-9qq8-c86cCGA-hg86-wfj2-72vqCGA-hq84-x7jr-rp53CGA-m38x-9v84-w7xmCGA-m4gh-92r4-6vjhCGA-m869-945v-qfvjCGA-m9xj-gfq2-ppfwCGA-mh4j-8vhp-p37pCGA-mj69-435g-mvxqCGA-mm2c-5w8q-gpwwCGA-p3j9-c4r8-4h8hCGA-p866-rwg5-qx54CGA-pfm4-wf39-356vCGA-pjr5-q5vm-qrf4CGA-pp9h-w45q-hh6rCGA-px8m-x3rf-j42jCGA-q8xg-4x24-wh4fCGA-r5gc-qcc8-76mjCGA-rf4f-wfvh-75cxCGA-rqqw-mhm8-mf8wCGA-rrfj-8g9q-9r72CGA-v49w-3xjp-2qwcCGA-v5j3-3wx9-wpjhCGA-vmf5-c85f-hrw5CGA-vmfr-cr64-m68fCGA-w2ch-855j-wvp4CGA-w4w7-pjxq-f5xxCGA-w9fq-xh55-3vrmCGA-wc76-c8h9-6mq3CGA-wgmx-cvmr-ffc2CGA-whw2-9ww3-5h4hCGA-wjqc-8c7j-cx8wCGA-wm75-jx8j-xvh6CGA-x2w8-p8vf-8hqjCGA-x9x9-r5vx-2r84CGA-xj58-rjg2-w7r9CGA-xjpx-6fcw-fgq6
Published 14-07-2026Last modified 15-07-2026
Vulnerability summary
CVE-2026-49458 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in cure53 dompurify. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33.2% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
6.1/10
010
Medium · v3.1 (CVE.org)EPSS score
0.40%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 14-07-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches so executable markup could survive. This issue is fixed in version 3.4.6.
CVSS metrics
7 scores · 7 sources · 1 versionMedium 6.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · NpmEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
33%
Versus all other CVEs
30-day change
0.00 pp
From 0.40% on 20-09-2026
20-09-202620-10-2026
EPSS score0.40%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundDompurify
Maturity: poc
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-501Trust Boundary ViolationThe product mixes trusted and untrusted data in the same data structure or structured message.
- CWE-693Protection Mechanism FailureThe product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Affected systems
Chainguard50 products
- airflow-2All versions (No fix recorded)
- airflow-core-2All versions (No fix recorded)
- gitlab-rails-ce-18.1All versions (No fix recorded)
- gitlab-rails-ce-18.10All versions (No fix recorded)
- gitlab-rails-ce-18.11All versions (No fix recorded)
Wolfi4 products
- langfuse-3-compat< 3.225.7-r6
- langfuse-3-worker< 3.188.0-r0
- nextcloud-server-32< 32.0.12-r0
- nextcloud-server-33< 33.0.6-r0
Ubuntu2 products
- dompurify.jsAll versions (No fix recorded)
- node-dompurifyAll versions (No fix recorded)
Cure531 product
- dompurify< 3.4.6
Debian1 product
- node-dompurifyAll versions (No fix recorded) | < 3.4.12+dfsg-1
Npm1 product
- dompurify< 3.4.6
6 vendors · 59 products
References
9 links- github.com/cure53/DOMPurify/security/advisories/GHSA-hpcv-96wg-7vj8X Refsource CONFIRMREPORTAdvisoryWEBExploitMitigationVendor Advisory
- github.com/cure53/DOMPurify/commit/bb7739e5bccec7e1ab3dae3f3e42d02db3acaaaeX Refsource MISCREPORTFIXPatch
- github.com/cure53/DOMPurifyPACKAGE