Summary DOMPurify 3.4.4 allows selectedcontent by default, allowing a chain in which browsers "re-clone" an XSS payload after sanitization, effectively bypassing DOMPurify. Details The chain is as follows: 1. The browse…
| CVE ID | CVE-2026-47423 |
| Vendor | npm |
| Affected Product | dompurify |
| Vulnerability Type | Vulnerability |
| CVSS Score | 8.2 (HIGH) |
| Actively Exploited | ❌ No known exploitation |
| Patch Status | See Vendor Advisory → |
| Reported By | CYBERDUDEBIVASH SENTINEL APEX Intelligence (via github_advisories) |
#
DOMPurify 3.4.4 allows selectedcontent by default, allowing a chain in which browsers "re-clone" an XSS payload after sanitization, effectively bypassing DOMPurify.
The chain is as follows: 1. The browser parses the input and creates a clone from the selected 2. DOMPurify walks and sanitizes that generated clone. 3. DOMPurify reaches the original and removes selected=javascript:1 4. The browser refreshes the clone from the original option's content. 5. The refreshed clone is in a subtree DOMPurify already walked, which DOMPurify doesn't go back to sanitize 6. The returned string contains unsanitized markup inside .
```js const dirty = ' ' + ' ' + ' x' + ' '; const clean = DOMPurify.sanitize(dirty); console.log(clean); document.body.i
Sigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.