VYPR
← All advisories
High severity8.2NVD Advisory· Published Jul 14, 2026· Updated Jul 21, 2026

CVE-2026-47423

CVE-2026-47423

Description

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an XSS payload after sanitization so that unsanitized markup inside is returned. This issue is fixed in version 3.4.5.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
dompurifynpm
>= 3.4.4, < 3.4.53.4.5

Affected products

2
  • Cure53/Dompurify2 versions
    cpe:2.3:a:cure53:dompurify:3.4.4:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:cure53:dompurify:3.4.4:*:*:*:*:*:*:*
    • (no CPE)range: <3.4.5

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.