{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.4.6"}],"component":"dompurify","cve_ids":["CVE-2026-65901"],"ecosystem":"npm","epss":0.00285,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-x4vx-rjvf-j5p4","id":"tcs_01M5KGGXJF2A48VNZB5N2G3CS3","modified_at":"2026-09-10T03:50:51.192721006Z","published_at":"2026-06-15T20:00:02Z","references":["https://osv.dev/vulnerability/GHSA-x4vx-rjvf-j5p4","https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4","https://github.com/cure53/DOMPurify"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-x4vx-rjvf-j5p4","url":"https://osv.dev/vulnerability/GHSA-x4vx-rjvf-j5p4"}],"summary":"DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects"}