CVE-2026-49459

DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.

We have discovered 63,650 live websites that are affected by CVE-2026-49459.

Run a Free Instant Scan



Affected Software

Product  DOMPurify
Category JavaScript Libraries
Vulnerable Domains63,650 live websites (100% of DOMPurify install base)
Vulnerable Versions
  • from 0 through 3.4.6
Vulnerable Versions Count67 versions ( 94% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Jul 14, 2026
  • Updated - Jul 15, 2026

Website Distribution by Country

Number of websites using CVE-2026-49459
United States17,531 websites


Germany8,640 websites
France3,898 websites
Japan2,889 websites
GB2,597 websites
Netherlands2,443 websites
Brazil2,181 websites
Italy1,993 websites
Poland1,841 websites
Switzerland1,558 websites

Website Distribution by TLD

Number of websites using CVE-2026-49459
.com24,250 websites
.de6,008 websites
.org2,873 websites
.nl2,193 websites
.com.br2,025 websites
.fr1,808 websites
.co.uk1,533 websites
.it1,453 websites
.net1,417 websites
.pl1,397 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-49459

Top websites that are affected by CVE-2026-49459. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*******.*****.com United States*,***
*****.*********.com United States*,***
********.org United States*,***
***********.ch Switzerland*,***
*****.com United States*,***
********.org United States*,***
***********.dk Denmark*,***
************.org France*,***
*********.com United States*,***
*************.com United States*,***
See full domain list

FAQ

CVE-2026-49459 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in DOMPurify
A total of 63,650 websites have been identified as vulnerable to CVE-2026-49459, based on global website indexing conducted by WebTechSurvey.
The DOMPurify is affected by the CVE-2026-49459 vulnerability.
DOMPurify versions up to 3.4.6 are vulnerable to CVE-2026-49459.
CVE-2026-49459 is resolved in version 3.4.6 of DOMPurify.