DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6,
    DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-
    controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because
    _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed
    in version 3.4.6. (CVE-2026-49459)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6,     DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-     controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because
    _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed     in version 3.4.6. (CVE-2026-49459)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
464746	Echo: dompurify: security update to 3.4.6	Tenable Cloud Security	Echo Local Security Checks	Local	medium
464746	Echo: dompurify: security update to 3.4.6	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
327175	Linux Distros Unpatched Vulnerability : CVE-2026-49459	Nessus	Misc.	Local	medium
443248	SCA: security update for dompurify (GHSA-r47g-fvhr-h676)	Tenable Cloud Security	SCA Checks	Local	medium
443248	SCA: security update for dompurify (GHSA-r47g-fvhr-h676)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-49459

medium

Tenable Plugins

medium

medium

medium

medium

medium