---
cve: "CVE-2026-49459"
severity: "MEDIUM"
cvss: 6.1
epss: "0.4%"
vendor: "cure53"
kev: false
exploited: false
published: "2026-07-14 21:17:01"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T11:32:38+01:00"
---

# CVE-2026-49459

> 6.1 MEDIUM · 🧪 PoC

## Beschreibung

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled  root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2026-07-15 14:17:27
- CNA-CVSS: **6.1** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **no**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Erforderlich | good |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Gering | warn |
| I Integrität | Gering | warn |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-1321** — Improperly Controlled Modification of Object Prototype Attributes
  The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
- **CWE-693** — Protection Mechanism Failure
  The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
- **CWE-79** — Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
  The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

## Angriffsmuster (CAPEC)

- [CAPEC-1 — Accessing Functionality Not Properly Constrained by ACLs](https://capec.mitre.org/data/definitions/1.html) _(Severity: High)_
- [CAPEC-77 — Manipulating User-Controlled Variables](https://capec.mitre.org/data/definitions/77.html) _(Severity: Very High)_
- [CAPEC-180 — Exploiting Incorrectly Configured Access Control Security Levels](https://capec.mitre.org/data/definitions/180.html) _(Severity: Medium)_

## ATT&CK-Techniken

- [T1574.010 — Hijack Execution Flow: ServicesFile Permissions Weakness](https://attack.mitre.org/techniques/T1574/010/)

## Patch verfügbar (OSV)

- bb7739e5bccec7e1ab3dae3f3e42d02db3acaaae (Commit)

## Referenzen

- <https://github.com/cure53/DOMPurify/security/advisories/GHSA-r47g-fvhr-h676>
- <https://github.com/cure53/DOMPurify/commit/bb7739e5bccec7e1ab3dae3f3e42d02db3acaaae>
- <https://github.com/cure53/DOMPurify/releases/tag/3.4.6>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-49459/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_