Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-14T20:01:44 dompurify: DOMPurify: Cross-site scripting bypass allows arbitrary script execution 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N CWE-79

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.

A flaw was found in DOMPurify, a library designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. A remote attacker could exploit a vulnerability in the `DOMPurify.sanitize` function when used with the `IN_PLACE: true` option. This flaw allows an attacker to bypass the sanitizer and inject malicious event-handler attributes into an attacker-controlled form element. Successful exploitation could lead to the execution of arbitrary scripts in the user's browser, potentially compromising user data or session integrity.

This Moderate-impact cross-site scripting (XSS) bypass in DOMPurify arises when the `DOMPurify.sanitize` function is invoked with the `IN_PLACE: true` option on an attacker-controlled HTML form element. Successful exploitation requires a specific application configuration where untrusted HTML is processed in this manner, allowing malicious event handlers to persist and execute arbitrary scripts. Red Hat products are generally not affected by default configurations, as this specific usage pattern is uncommon. Migration Toolkit for Virtualization Under investigation migration-toolkit-virtualization/mtv-console-plugin-rhel9 Migration Toolkit for Virtualization Under investigation mtv-candidate/mtv-console-plugin-rhel9 Multicluster Engine for Kubernetes Under investigation multicluster-engine/console-mce-rhel9 Node HealthCheck Operator Under investigation workload-availability/node-healthcheck-must-gather-rhel9 Node HealthCheck Operator Under investigation workload-availability/node-healthcheck-operator-bundle Node HealthCheck Operator Under investigation workload-availability/node-healthcheck-rhel9-operator OpenShift Lightspeed Under investigation openshift-lightspeed/lightspeed-agentic-console-rhel9 OpenShift Lightspeed Under investigation openshift-lightspeed/lightspeed-console-plugin-419-rhel9 OpenShift Lightspeed Under investigation openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 OpenShift Lightspeed Under investigation openshift-lightspeed/lightspeed-console-plugin-rhel9 OpenShift Service Mesh 3 Under investigation openshift-service-mesh/kiali-ossmc-rhel9 OpenShift Service Mesh 3 Under investigation openshift-service-mesh/kiali-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Under investigation rhacm2/console-rhel9 Red Hat Advanced Cluster Security 4 Under investigation advanced-cluster-security/rhacs-main-rhel8 Red Hat Advanced Cluster Security 4 Under investigation advanced-cluster-security/rhacs-main-rhel9 Red Hat AMQ Broker 7 Under investigation dompurify Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/gateway-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/gateway-rhel9 Red Hat build of Apache Camel for Spring Boot 4 Under investigation dompurify Red Hat Build of Podman Desktop Under investigation rh-podman-desktop.git Red Hat Ceph Storage 9 Under investigation rhceph/alloy-rhel10 Red Hat Data Grid 8 Under investigation dompurify Red Hat Developer Hub Under investigation rhdh/rhdh-hub-rhel9 Red Hat Hardened Images Not affected ruff Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-dashboard-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-automl-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-eval-hub-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-gen-ai-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-maas-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-console Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-console-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-monitoring-plugin-rhel8 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-monitoring-plugin-rhel9 Red Hat Openshift Data Foundation 4 Under investigation odf4/ocs-client-console-rhel9 Red Hat Openshift Data Foundation 4 Under investigation odf4/odf-console-rhel9 Red Hat Openshift Data Foundation 4 Under investigation odf4/odf-multicluster-console-rhel9 Red Hat OpenShift Dev Spaces Under investigation devspaces/code-rhel9 Red Hat OpenShift Dev Spaces Under investigation devspaces/openvsx-rhel9 Red Hat OpenShift GitOps Under investigation openshift-gitops-1/argocd-rhel8 Red Hat OpenShift GitOps Under investigation openshift-gitops-1/argocd-rhel9 Red Hat OpenShift Virtualization 4 Under investigation container-native-virtualization/kubevirt-console-plugin Red Hat OpenShift Virtualization 4 Under investigation container-native-virtualization/kubevirt-console-plugin-rhel9 Self-service automation portal 2 Fix deferred ansible-automation-platform/automation-portal https://www.cve.org/CVERecord?id=CVE-2026-49459 https://nvd.nist.gov/vuln/detail/CVE-2026-49459 https://github.com/cure53/DOMPurify/commit/bb7739e5bccec7e1ab3dae3f3e42d02db3acaaae https://github.com/cure53/DOMPurify/releases/tag/3.4.6 https://github.com/cure53/DOMPurify/security/advisories/GHSA-r47g-fvhr-h676