Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
DOMPurify Improper Check for Unusual or Exceptional Conditions Vulnerability - CVE-2026-65904 - Vulnerability Database
DOMPurify

DOMPurify Improper Check for Unusual or Exceptional Conditions Vulnerability - CVE-2026-65904

Medium
Reference: CVE-2026-65904
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-65904
Title: DOMPurify Improper Check for Unusual or Exceptional Conditions Vulnerability
Overview:

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g. an iframe39s contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes causing DOMPurify to stringify the element (yielding 39object HTMLDivElement39) silently reset IN_PLACE to false and return the unsanitized element unchanged with any XSS payloads intact.