CVE-2026-49459 is a cross-site scripting vulnerability in the DOMPurify library before version 3.4.6. When using DOMPurify.sanitize(root, { IN_PLACE: true }), event-handler attributes on an attacker-controlled <form> root element could be preserved if a descendant element's name clobbered properties checked by the internal _isClobbered function. This happens because the _forceRemove function no-ops on a parent-less root and _sanitizeAttributes returns early, allowing malicious event handlers to remain. The vulnerability is addressed by fixes applied in version 3.4.6.

This vulnerability allows an attacker to inject and preserve malicious event-handler attributes in sanitized HTML, potentially enabling cross-site scripting attacks that can lead to partial compromise of confidentiality and integrity of affected web applications. The CVSS score of 6.1 reflects a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Upgrade DOMPurify to version 3.4.6 or later, where this vulnerability is fixed. No other mitigation is indicated or required as the fix addresses the root cause directly.