CVE-2026-47423

DOMPurify XSS via `selectedcontent` re-clone

Published Jul 14, 2026 CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Description

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an XSS payload after sanitization so that unsanitized markup inside <selectedcontent> is returned. This issue is fixed in version 3.4.5.

Analysis

Technical impact

DOMPurify is a DOM‑only cross‑site scripting sanitizer for HTML, MathML, and SVG. In version 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re‑clone an XSS payload after sanitization so that unsanitized markup inside <selectedcontent> is returned. Because the sanitizer does not strip this element, attackers can embed script code that will be executed when the content renders. This flaw is identified as CWE‑79 and may allow arbitrary script injection, compromising confidentiality, integrity, and availability. The issue is fixed in DOMPurify 3.4.5.

Affected Systems

Applications that include the DOMPurify library at version 3.4.4 or older, as distributed by cure53, are affected. The bug was addressed in the 3.4.5 release; any deployment still using 3.4.4 or earlier remains vulnerable.

Risk and Exploitability

The vulnerability has a CVSS score of 8.2, classifying EPSS score is below 1 %, indicating that real‑world exploitation is currently uncommon, and the bug has not yet been listed in the CISA KEV catalog. The likely attack vector involves a web application that uses DOMPurify to sanitize user input and then renders the sanitized content in a browser that supports the <selectedcontent> element. An attacker can craft payloads containing <selectedcontent> tags, cause the browser to re‑clone the payload, and execute the injected script within the victim’s context.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

cure53

DOMPurify

affected

Version	Status	Constraints
`>= 3.4.4, < 3.4.5`	affected	—

Configuration 1 [-]

cpe:2.3:a:cure53:dompurify:3.4.4:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Cure53

Dompurify

Version	Status	Scheme	Platform
`[3.4.4,3.4.5)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade DOMPurify to version 3.4.5 or later to eliminate the <selectedcontent> re‑cloning flaw.
If upgrading immediately is not possible, remove or escape <selectedcontent> elements from user input before passing the content to DOMPurify.
Deploy a restrictive Content Security Policy that blocks inline scripts and limits script sources to safe scripts.

Generated by OpenCVE AI on July 31, 2026 at 05:10 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-87xg-pxx2-7hvx	DOMPurify XSS via selectedcontent re-clone

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.410% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/cure53/DOMPurify/commit/011b0c78f2a0f57ee54f5fcccb697a46ca6e63ea
https://github.com/cure53/DOMPurify/releases/tag/3.4.5
https://github.com/cure53/DOMPurify/security/advisories/GHSA-87xg-pxx2-7hvx
https://nvd.nist.gov/vuln/detail/CVE-2026-47423
https://www.cve.org/CVERecord?id=CVE-2026-47423

History

Jul 16, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 15, 2026 4:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Cure53 Cure53 dompurify
Vendors & Products		Cure53 Cure53 dompurify

Jul 15, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-47423 https://www.cve.org/CVERecord?id=CVE-2026-47423
Metrics	threat_severity `None`	threat_severity `Important`

Jul 14, 2026 8:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an XSS payload after sanitization so that unsanitized markup inside <selectedcontent> is returned. This issue is fixed in version 3.4.5.
Title		DOMPurify XSS via `selectedcontent` re-clone
Weaknesses		CWE-79
References		https://github.com/cure53/DOMPurify/commit/011b0c78f2a0f57ee54f5fcccb697a46ca6e63ea https://github.com/cure53/DOMPurify/releases/tag/3.4.5 https://github.com/cure53/DOMPurify/security/advisories/GHSA-87xg-pxx2-7hvx
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N'}`