Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-65901 →
DEBIAN-CVE-2026-65901
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
node-dompurify
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
node-dompurify
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
node-dompurify
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.12+dfsg-1"}]}]
Références
- advisory security-tracker.debian.org