Debian/node-dompurify: medium 6.1

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects wi

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: DEBIAN-CVE-2026-65901
• https://security-tracker.debian.org/tracker/CVE-2026-65901

published 2026-07-23T14:18:05Z · modified 2026-10-25T09:47:29.113791530Z · JSON