Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-14T19:58:50 dompurify: DOMPurify: Cross-site scripting due to improper sanitization of DOM nodes 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CWE-79

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches so executable markup could survive. This issue is fixed in version 3.4.6.

A flaw was found in DOMPurify, a tool designed to prevent cross-site scripting (XSS) attacks by sanitizing HTML, MathML, and SVG content. When processing certain types of web page elements, DOMPurify failed to properly identify and sanitize malicious code. This oversight could allow an attacker to inject and execute harmful scripts within a user's web browser, potentially leading to information disclosure or unauthorized actions.

This Moderate cross-site scripting (XSS) flaw in DOMPurify arises when the `DOMPurify.sanitize()` function is used with the `IN_PLACE: true` option on DOM nodes originating from a different realm (e.g., an iframe). This misconfiguration bypasses critical sanitization checks, allowing executable markup to persist. Red Hat products utilizing DOMPurify in this specific manner could be vulnerable to information disclosure or unauthorized actions if processing untrusted content. Migration Toolkit for Virtualization Under investigation migration-toolkit-virtualization/mtv-console-plugin-rhel9 Migration Toolkit for Virtualization Under investigation mtv-candidate/mtv-console-plugin-rhel9 Multicluster Engine for Kubernetes Under investigation multicluster-engine/console-mce-rhel9 Node HealthCheck Operator Under investigation workload-availability/node-healthcheck-must-gather-rhel9 Node HealthCheck Operator Under investigation workload-availability/node-healthcheck-operator-bundle Node HealthCheck Operator Under investigation workload-availability/node-healthcheck-rhel9-operator OpenShift Lightspeed Under investigation openshift-lightspeed/lightspeed-agentic-console-rhel9 OpenShift Lightspeed Under investigation openshift-lightspeed/lightspeed-console-plugin-419-rhel9 OpenShift Lightspeed Under investigation openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 OpenShift Lightspeed Under investigation openshift-lightspeed/lightspeed-console-plugin-rhel9 OpenShift Service Mesh 3 Under investigation openshift-service-mesh/kiali-ossmc-rhel9 OpenShift Service Mesh 3 Under investigation openshift-service-mesh/kiali-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Under investigation rhacm2/console-rhel9 Red Hat Advanced Cluster Security 4 Under investigation advanced-cluster-security/rhacs-main-rhel8 Red Hat Advanced Cluster Security 4 Under investigation advanced-cluster-security/rhacs-main-rhel9 Red Hat AMQ Broker 7 Under investigation dompurify Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/gateway-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/gateway-rhel9 Red Hat build of Apache Camel for Spring Boot 4 Under investigation dompurify Red Hat Build of Podman Desktop Under investigation rh-podman-desktop.git Red Hat Ceph Storage 9 Under investigation rhceph/alloy-rhel10 Red Hat Data Grid 8 Under investigation dompurify Red Hat Developer Hub Under investigation rhdh/rhdh-hub-rhel9 Red Hat Hardened Images Not affected ruff Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-dashboard-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-automl-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-eval-hub-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-gen-ai-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-maas-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-console Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-console-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-monitoring-plugin-rhel8 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-monitoring-plugin-rhel9 Red Hat Openshift Data Foundation 4 Under investigation odf4/ocs-client-console-rhel9 Red Hat Openshift Data Foundation 4 Under investigation odf4/odf-console-rhel9 Red Hat Openshift Data Foundation 4 Under investigation odf4/odf-multicluster-console-rhel9 Red Hat OpenShift Dev Spaces Under investigation devspaces/code-rhel9 Red Hat OpenShift Dev Spaces Under investigation devspaces/openvsx-rhel9 Red Hat OpenShift GitOps Under investigation openshift-gitops-1/argocd-rhel8 Red Hat OpenShift GitOps Under investigation openshift-gitops-1/argocd-rhel9 Red Hat OpenShift Virtualization 4 Under investigation container-native-virtualization/kubevirt-console-plugin Red Hat OpenShift Virtualization 4 Under investigation container-native-virtualization/kubevirt-console-plugin-rhel9 Self-service automation portal 2 Fix deferred ansible-automation-platform/automation-portal https://www.cve.org/CVERecord?id=CVE-2026-49458 https://nvd.nist.gov/vuln/detail/CVE-2026-49458 https://github.com/cure53/DOMPurify/commit/bb7739e5bccec7e1ab3dae3f3e42d02db3acaaae https://github.com/cure53/DOMPurify/releases/tag/3.4.6 https://github.com/cure53/DOMPurify/security/advisories/GHSA-hpcv-96wg-7vj8