Vulnerability Description
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Related Weaknesses (CWE)
References
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7
- https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-i
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7
FAQ
What is CVE-2026-75838?
CVE-2026-75838 is a documented vulnerability. DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event ha...
How severe is CVE-2026-75838?
CVSS scoring is not yet available for CVE-2026-75838. Check NVD for updates.
Is there a patch for CVE-2026-75838?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.