CVE-2026-109344
published 2026-10-12CVE-2026-109344: DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by…
PriorityP425medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.19%
8.0th percentile
DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on* handlers inside a wrapper removed by such hooks, leaving handlers armed on the live DOM to execute script in the victim origin.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cure53 | dompurify | >= 3.4.13 < 3.4.16 | 3.4.16 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv4.05.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks.
ghsa_unreviewed·2026-10-12
CVE-2026-109344 [MEDIUM] CWE-79 DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks.
DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on* handlers inside a wrapper removed by such hooks, leaving handlers armed on the live DOM to execute script in the victim origin.
Red Hat
dompurify: DOMPurify: Cross-Site Scripting via unneutralized elements detached during in-place sanitization
vendor_redhat·2026-10-12·CVSS 6.1
CVE-2026-109344 [MEDIUM] CWE-79 dompurify: DOMPurify: Cross-Site Scripting via unneutralized elements detached during in-place sanitization
dompurify: DOMPurify: Cross-Site Scripting via unneutralized elements detached during in-place sanitization
A flaw was found in DOMPurify. When performing in-place sanitization directly on active webpage elements, the library fails to neutralize content detached by post-processing hooks. A remote attacker can exploit this issue by supplying crafted markup containing malicious event handlers inside elements removed by these hooks. Successful exploitation allows the malicious scripts to execute within the victim browser session, leading to Cross-Site Scripting (XSS).
Package: grafana12.4 (Red Hat Hardened Images) - Affected
Package: grafana13.1 (Red Hat Hardened Images) - Affected
Package: grafana13.2 (Red Hat Hardened Images) - Affected
Package: ruff (Red Hat Hardened Images) - Not aff
No detection rules found.
No public exploits indexed.
2026-10-12
Published