CVE-2026-75838
MediumCVSS 5.1Summary
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Risk Assessment
The risk is the possibility of executing malicious scripts in the victim's browser, which can lead to data theft, session hijacking, or other attacks. The vulnerability can be exploited in applications using DOMPurify to sanitize user input.
Recommendation
It is recommended to upgrade DOMPurify to version 3.4.13 or later, which includes the fix. Also review IN_PLACE sanitization implementations to ensure detached subtrees are properly neutralized.
Original NVD description (English source)
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.