All vulnerabilities
CVE-2026-116803GHSA-mrv2-3pqr-j5jr

DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees

cure53 DOMPurifynpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.1Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in3.4.17Fixed versionCVE List
Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

  • 3.4.17DOMPurifyCVE List
  • 3.4.17dompurify, npmOSVnpm install dompurify@3.4.17

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.

Text from CVE List

Affected versions 3

  • DOMPurifyaffected: all versions before 3.4.17CVE List
  • DOMPurifyunaffected: 3.4.17CVE List
  • dompurify, npmfrom first release, fixed in 3.4.17OSV

References 2