dompurify: DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects
DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects (low). GHSA-x4vx-rjvf-j5p4, CVE-2026-65901.
osv.devquote checked- security advisory
- Your codeby hand
Nemotron fixes
In its own wordsmatches the page ✓
DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects
What Teire looks for in your code
nothing to search for: checked by hand
Does it reach your code?