DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches so executable markup could survive. This issue is fixed in version 3.4.6.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6,
    DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on
    checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document
    fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches
    so executable markup could survive. This issue is fixed in version 3.4.6. (CVE-2026-49458)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6,     DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on     checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document     fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches     so executable markup could survive. This issue is fixed in version 3.4.6. (CVE-2026-49458)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
463386	Echo: dompurify: security update to 3.4.6	Tenable Cloud Security	Echo Local Security Checks	Local	medium
463386	Echo: dompurify: security update to 3.4.6	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
327127	Linux Distros Unpatched Vulnerability : CVE-2026-49458	Nessus	Misc.	Local	medium
443239	SCA: security update for dompurify (GHSA-hpcv-96wg-7vj8)	Tenable Cloud Security	SCA Checks	Local	medium
443239	SCA: security update for dompurify (GHSA-hpcv-96wg-7vj8)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-49458

medium

Tenable Plugins

medium

medium

medium

medium

medium