CVE-2026-47423 PUBLISHED

DOMPurify XSS via `selectedcontent` re-clone

Assigner: GitHub_M
Reserved: 19.05.2026 Published: 14.07.2026 Updated: 14.07.2026

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an XSS payload after sanitization so that unsanitized markup inside <selectedcontent> is returned. This issue is fixed in version 3.4.5.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
CVSS Score: 8.2

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	Low
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	cure53
Product	DOMPurify
Versions	Version >= 3.4.4, < 3.4.5 is affected

References

https://github.com/cure53/DOMPurify/security/advisories/GHSA-87xg-pxx2-7hvx
https://github.com/cure53/DOMPurify/commit/011b0c78f2a0f57ee54f5fcccb697a46ca6e63ea
https://github.com/cure53/DOMPurify/releases/tag/3.4.5

Problem Types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE