DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects
Low highest severity reported · also known as CVE-2026-65901
1
catalog tools match this advisory
0
ship the vulnerable code in their release binary (Go tools analyzed with govulncheck)
Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary. KEV: listed in the CISA Known Exploited Vulnerabilities catalog. EPSS: FIRST's estimated probability of exploitation in the next 30 days. Both describe the vulnerability in general, not its exploitability through this tool; a match in a workflow file refers to a GitHub Action, not to shipped code. Released binary is only analyzed for Go tools with a Linux release binary; other tools show not analyzed.