galaxy-sc/cve-2026-47423-dompurify-xss-detectorGo-based scanner that detects DOMPurify sanitizer bypass (CVE-2026-47423) via logic fingerprinting on minified production JavaScript bundles, identifying unpatched allowed-tag layouts.
A lightweight, high-performance scanner written in Go to detect production deployments of DOMPurify vulnerable to a complete sanitizer bypass via the <selectedcontent> re-clone logic flaw.
Instead of relying on easily stripped source comments or version variables, this tool performs logic fingerprinting on minified production JavaScript bundles to identify unpatched allowed-tag layouts.
In DOMPurify versions up to 3.4.4, the <selectedcontent> element was allowed by default. This introduces a logic flaw where Chromium/WebKit browsers refresh and re-clone the <selectedcontent> subtree after DOMPurify has already executed its sanitization pass, leading to an absolute XSS bypass when the payload is injected into the live DOM.
# Clone the repository
git clone https://github.com/Galaxy-sc/CVE-2026-47423-dompurify-xss-detector.git
cd CVE-2026-47423-dompurify-xss-detector
# Run against a target using parameters
go run CVE-2026-47423.go -u https://example.com
Update dompurify to version 3.4.5 or higher via your package manager:
npm install [email protected]
If an immediate upgrade is not feasible, manually block the tag in your config layout:
DOMPurify.sanitize(userInput, { FORBID_TAGS: ['selectedcontent'] });