Input validation error in DOMPurify - CVE-2026-49458

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU132355

Input validation error in DOMPurify - CVE-2026-49458

Published: May 27, 2026


Vulnerability identifier: #VU132355
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-49458
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.

The vulnerability exists due to improper input validation in the IN_PLACE sanitization logic when processing markup across realms. A remote attacker can supply specially crafted markup that bypasses realm-bound instanceof checks to execute arbitrary script in the victim's browser.

User interaction is required to process the crafted content.


Affected software

DOMPurify
Db2 Developer Extension
InfoSphere Optim Archive Viewer

How to mitigate CVE-2026-49458

Install security update from vendor's website.

DOMPurify - update to 3.4.6
Db2 Developer Extension - update to 1.2.0
InfoSphere Optim Archive Viewer - update to 11.7.0.15

External References

Related Security Bulletins