[Davithi]

Updates

• Affected products
• References

Comments
The advisory lists no patched version. The vulnerability is fixed in dompurify 3.4.8, so the range should be < 3.4.8.

The advisory describes _sanitizeElements taking the tag name from the instance-visible currentNode.nodeName (code path [A]). Commit cure53/DOMPurify@d359b99 ("refined an element nodeName check for better robustness", 2026-05-29) changes exactly that line to read the tag name through the cached Node.prototype.nodeName getter (getNodeName(currentNode)). The commit is in tag 3.4.8 and not in 3.4.7.

Note that the upstream repository advisory lists 3.4.7 as patched, but 3.4.7 is still vulnerable: src/purify.ts at tag 3.4.7 still has const tagName = transformCaseFunc(currentNode.nodeName);. I checked it with jsdom, using a real <script> child whose nodeName is overridden and DOMPurify.sanitize(root, { IN_PLACE: true }):

const script = doc.createElement('script');
script.textContent = 'alert(1)';
Object.defineProperty(script, 'nodeName', { value: 'P' });
root.appendChild(script);
DOMPurify.sanitize(root, { IN_PLACE: true });
// is the <script> still in root?

version	spoofed <script> kept
3.4.6	yes (vulnerable)
3.4.7	yes (vulnerable)
3.4.8	no (fixed)
3.4.16	no (fixed)

A plain <script> without the spoofed nodeName is removed by all four versions.

🤖 Generated with Claude Code