CVE-2026-109345
published 2026-10-12CVE-2026-109345: DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a…
PriorityP425medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.20%
9.9th percentile
DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the returned node.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cure53 | dompurify | < 3.4.16 | 3.4.16 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv4.05.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still
ghsa_unreviewed·2026-10-12
CVE-2026-109345 [MEDIUM] CWE-79 DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still
DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the returned node.
Red Hat
dompurify: DOMPurify: Cross-site scripting via unsanitized raw text in in-place mode
vendor_redhat·2026-10-12·CVSS 6.1
CVE-2026-109345 [MEDIUM] CWE-79 dompurify: DOMPurify: Cross-site scripting via unsanitized raw text in in-place mode
dompurify: DOMPurify: Cross-site scripting via unsanitized raw text in in-place mode
A flaw was found in DOMPurify. This vulnerability allows a remote attacker to conduct cross-site scripting (XSS) attacks by bypassing HTML sanitization when the library operates in in-place mode. When processing raw text elements containing embedded markup, the library removes the element but fails to neutralize its text content before returning the node. If the application subsequently serializes and re-parses the returned content, the embedded script executes within the user's browser session.
Package: grafana12.4 (Red Hat Hardened Images) - Affected
Package: grafana13.1 (Red Hat Hardened Images) - Affected
Package: grafana13.2 (Red Hat Hardened Images) - Affected
Package: ruff (Red Hat Hardened Ima
No detection rules found.
No public exploits indexed.
2026-10-12
Published