CVE-2026-65901 describes a cross-site scripting vulnerability in DOMPurify up to version 3.4.6. The issue arises in IN_PLACE mode where the sanitizer trusts the nodeName property of live non-form DOM nodes, which can be manipulated by attackers. By supplying hostile live DOM objects with script children and altering the observable nodeName to appear as allowed elements, attackers can cause script execution upon insertion of the sanitized tree into a live document. This undermines the sanitization process and leads to potential XSS attacks.

Successful exploitation allows attackers to execute arbitrary scripts in the context of the affected web page, potentially leading to session hijacking, defacement, or other malicious actions. The vulnerability affects the integrity of the sanitization process in DOMPurify and can compromise client-side security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is provided in the available data. Users should monitor the vendor's announcements for patches addressing this vulnerability. Until a fix is available, avoid using IN_PLACE mode with untrusted input or consider alternative sanitization methods.