Cross-site scripting in DOMPurify - CVE-2026-49459

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU132356

Cross-site scripting in DOMPurify - CVE-2026-49459

Published: May 27, 2026


Vulnerability identifier: #VU132356
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-49459
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary script code in the victim's browser.

The vulnerability exists due to improper neutralization of script-related html attributes in the in_place mode root element handling when sanitizing attacker-controlled root dom content. A remote attacker can supply a crafted root element whose clobbered attributes are preserved to execute arbitrary script code in the victim's browser.

User interaction is required to load or process the crafted content.


Affected software

DOMPurify
Db2 Developer Extension
InfoSphere Optim Archive Viewer

How to mitigate CVE-2026-49459

Install security update from vendor's website.

DOMPurify - update to 3.4.6
Db2 Developer Extension - update to 1.2.0
InfoSphere Optim Archive Viewer - update to 11.7.0.15

External References

Related Security Bulletins