Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-49459 DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-ha… https://www.cve.org/CVERecord?id=CVE-2026-49459
Post summary
CVE‑2026‑49459 is an XSS flaw in DOMPurify affecting versions before 3.4.6; upgrading to 3.4.6 or newer should remediate the vulnerability.
🚨*CVE* CVE-2026-49459 DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-ha… https://www.cve.org/CVERecord?id=CVE-2026-49459 ----- Traducción: CVE-2026-49459 DOM… http://infoflow.cloud`
Post summary
The tweet highlights CVE-2026-49459, noting that DOMPurify versions prior to 3.4.6 may allow event handlers to persist and potentially enable XSS; no PoC, exploit, or patch information is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | cure53 | dompurify | - | - | - |