https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T11:22:38.869047+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-1049 certfr-2026-avi-1049 — De multiples vulnérabilités ont été découvertes dans Oracle MySQL. Certaines d'entre elles permettent à un attaquant de… 2026-10-03T11:22:38.984236+00:00 certfr-2026-avi-1049 https://cve.radiocsirt.org/vuln/euvd-2026-339840 EUVD-2026-339840 2026-10-03T11:22:38.984280+00:00 EUVD-2026-339840 https://cve.radiocsirt.org/vuln/fkie_cve-2026-65901 fkie_cve-2026-65901 2026-10-03T11:22:38.984295+00:00

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.

 https://cve.radiocsirt.org/vuln/ghsa-x4vx-rjvf-j5p4 GHSA-x4vx-rjvf-j5p4 — DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and… 2026-10-03T11:22:38.984326+00:00

Affected: npm: dompurify

## Summary

When `DOMPurify.sanitize(root, { IN_PLACE: true })` is called on an attacker-supplied live DOM node, `DOMPurify` still trusts `currentNode.nodeName` for non-`form` nodes in the main `_sanitizeElements` pipeline. A real `<script>` child node whose observable `nodeName` is attacker-controlled can therefore be misclassified as an allowed element and retained. When the sanitized tree is inserted into a live document, the script executes.

This affects current `3.4.6`. The recent `IN_PLACE` hardening work covers clobbered `form` handling and foreign-realm shadow/template traversal, but does not harden the main per-node element decision for hostile non-`form` live nodes.

## Affected

- DOMPurify `3.4.6` - Any caller that does `DOMPurify.sanitize(node, { IN_PLACE: true })` on attacker-supplied live DOM nodes - Verified attacker-controlled node sources: - same-origin `iframe` → live node passed by reference - same-origin `window.open()` popup → live node passed by reference - same-origin foreign node adopted into the host document via `document.adoptNode(node)` and then sanitized in-place

Not affected:

- String-input `DOMPurify.sanitize(dirtyString)`

## Vulnerability details

### Code paths

[A] — `_sanitizeElements` uses the instance-visible `nodeName` for the allow/forbid decision:

```ts const _sanitizeElements = function (currentNode: any): boolean { ... if (_isClobbered(currentNode)) { _forceRemove(currentNode); return true; }

const tagNam…

 https://cve.radiocsirt.org/vuln/rhsa-2026:58500 RHSA-2026:58500 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update 2026-10-03T11:22:38.984402+00:00

dompurify: DOMPurify: Cross-site scripting via permanent attribute allowlist pollution dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset dompurify: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName dompurify: DOMPurify: Sanitization bypass via hook manipulation DOMPurify: DOMPurify: Cross-site scripting due to state leakage in sanitization. dompurify: DOMPurify: URI validation bypass leads to cross-site scripting dompurify: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode dompurify: DOMPurify: Cross-Site Scripting vulnerability allows arbitrary code execution

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-65901 UBUNTU-CVE-2026-65901 2026-10-03T11:22:38.984434+00:00

Affected: Ubuntu:22.04:LTS: node-dompurify, Ubuntu:24.04:LTS: node-dompurify, Ubuntu:26.04:LTS: node-dompurify

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.