CVE-2026-49459

Katalog CVE

CVSS 6.1 · Medium EPSS 0,37%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada cure53 dompurify. Skor CVSS 3.1 6.1 (Medium) menurut github.com.

Deskripsi (NVD)

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

21 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-693: Protection Mechanism Failure
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-r47g-fvhr-h676 exploit · mitigasi · advisory vendor
• https://github.com/cure53/DOMPurify/commit/bb7739e5bccec7e1ab3dae3f3e42d02db3acaaae patch
• https://github.com/cure53/DOMPurify/releases/tag/3.4.6 release notes