6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-49459

CVE-2026-49459: DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-49459

CVE-2026-49459:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
dompurify	npm	<= 3.4.5	3.4.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a logic flaw in DOMPurify's IN_PLACE sanitization mode. It arises from a combination of incorrect assumptions between different internal functions when handling a detached DOM root element, specifically a <form> element.

The core of the issue lies in the interaction between three functions:

_forceRemove: This function is supposed to remove a node. However, if the node has no parent (is a detached root), it fails silently without removing the node or signaling an error.
_isClobbered: This function checks if an element's properties have been overwritten by descendant elements (a 'DOM Clobbering' attack).
_sanitizeAttributes: This function is responsible for cleaning element attributes. It calls _isClobbered and, if it returns true, _sanitizeAttributes immediately stops execution for that element, assuming _forceRemove has already dealt with it.

When an attacker provides a clobbered, detached <form> element to DOMPurify.sanitize with {IN_PLACE: true}:

_sanitizeElements calls _forceRemove on the root form.
_forceRemove does nothing because the form has no parent.
The main loop continues and calls _sanitizeAttributes on the same root form.
_sanitizeAttributes calls _isClobbered, which returns true.
_sanitizeAttributes then immediately returns, skipping all attribute sanitization for the root element.

As a result, any malicious attributes (like onmouseover, onclick, etc.) on the root <form> element are left intact, leading to a Cross-Site Scripting (XSS) vulnerability when the 'sanitized' element is inserted into the main document.

The fix, identified in commit 428b9b662933534d94573994343385b93de2b559, was to add a check at the beginning of the main DOMPurify.sanitize function. This check detects if it's running in IN_PLACE mode on a detached, clobbered element and, if so, throws an exception, preventing the vulnerable logic from ever being reached.

Vulnerable functions

DOMPurify.sanitize

src/purify.ts

This is the main entry point for the sanitization process. The vulnerability is triggered when this function is called with the IN_PLACE option on a detached DOM node that is clobbered. The patch adds a check at the beginning of this function to detect this specific condition and throw an error, thus preventing the vulnerability.

_sanitizeAttributes

src/purify.ts

This function is responsible for sanitizing the attributes of a DOM node. It contains a check that makes it return prematurely if the node is considered 'clobbered', assuming that a clobbered node would have already been removed from the DOM. This assumption is incorrect for detached root nodes, causing the function to skip sanitization of attributes on the vulnerable root element.

_forceRemove

src/purify.ts

This function is intended to remove a node from the DOM. However, it fails silently if the node has no parent (i.e., it's a detached root node). This silent failure is a key part of the vulnerability, as it leads other functions like `_sanitizeAttributes` to operate on the incorrect assumption that the node has been removed.

_isClobbered

src/purify.ts

This function is used to detect if a DOM element has been 'clobbered' (i.e., if some of its properties have been overwritten by child elements). An attacker can craft an HTML input that causes this function to return `true` for the root element. This result is then used by `_sanitizeAttributes` to (incorrectly) decide to skip attribute sanitization.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.