CVE-2026-75838
published 2026-08-18CVE-2026-75838: DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached…
PriorityP425medium5.1CVSS 4.0
AVNACLATNPRLUIPVCNVINVANSCLSILSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.30%
21.6th percentile
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Affected
48 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | system-rhel8 | — | — |
| advanced-cluster-security | rhacs-main-rhel8 | — | — |
| advanced-cluster-security | rhacs-main-rhel9 | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-27 | gateway-rhel9 | — | — |
| ansible-automation-platform | automation-portal | — | — |
| apicurio | apicurio-registry-gitops-sync-rhel9 | — | — |
| apicurio | apicurio-registry-ui-rhel8 | — | — |
| container-native-virtualization | kubevirt-console-plugin | — | — |
| container-native-virtualization | kubevirt-console-plugin-rhel9 | — | — |
| cure53 | dompurify | < 3.4.13 | 3.4.13 |
| devspaces | code-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| migration-toolkit-virtualization | mtv-console-plugin-rhel9 | — | — |
| multicluster-engine | console-mce-rhel9 | — | — |
| odf4 | ocs-client-console-rhel9 | — | — |
| odf4 | odf-console-rhel9 | — | — |
| odf4 | odf-multicluster-console-rhel9 | — | — |
| openshift-gitops-1 | argocd-rhel8 | — | — |
| openshift-gitops-1 | argocd-rhel9 | — | — |
| openshift-service-mesh | kiali-ossmc-rhel9 | — | — |
| openshift-service-mesh | kiali-rhel9 | — | — |
| openshift4 | ose-agent-installer-ui-rhel9 | — | — |
| openshift4 | ose-console | — | — |
| openshift4 | ose-console-rhel9 | — | — |
CVSS provenance
nvdv4.05.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat5.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees.
ghsa_unreviewed·2026-08-18
CVE-2026-75838 [MEDIUM] CWE-79 DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees.
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Red Hat
dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization
vendor_redhat·2026-08-18·CVSS 5.1
CVE-2026-75838 [MEDIUM] CWE-79 dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization
dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during IN_PLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of malicious scripts even after the HTML appears to be sanitized, leading to potential information disclosure or unauth
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-75838 python-ipyparallel: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
bugzilla·2026-09-17·CVSS 5.1
CVE-2026-75838 [MEDIUM] CVE-2026-75838 python-ipyparallel: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
CVE-2026-75838 python-ipyparallel: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Bugzilla
CVE-2026-75838 openbao: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
bugzilla·2026-09-17·CVSS 5.1
CVE-2026-75838 [MEDIUM] CVE-2026-75838 openbao: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
CVE-2026-75838 openbao: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Discussion:
OpenBao has no server-side javascript so this vulnerability is not applicable
Bugzilla
CVE-2026-75838 grafana: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
bugzilla·2026-09-17·CVSS 5.1
CVE-2026-75838 [MEDIUM] CVE-2026-75838 grafana: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
CVE-2026-75838 grafana: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Bugzilla
CVE-2026-75838 ansible-collection-awx-awx: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
bugzilla·2026-09-17·CVSS 5.1
CVE-2026-75838 [MEDIUM] CVE-2026-75838 ansible-collection-awx-awx: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
CVE-2026-75838 ansible-collection-awx-awx: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Bugzilla
CVE-2026-75838 python-ipyparallel: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
bugzilla·2026-09-17·CVSS 5.1
CVE-2026-75838 [MEDIUM] CVE-2026-75838 python-ipyparallel: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
CVE-2026-75838 python-ipyparallel: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Bugzilla
CVE-2026-75838 python-jupytext: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
bugzilla·2026-09-17·CVSS 5.1
CVE-2026-75838 [MEDIUM] CVE-2026-75838 python-jupytext: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
CVE-2026-75838 python-jupytext: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Bugzilla
CVE-2026-75838 fbthrift: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
bugzilla·2026-09-17·CVSS 5.1
CVE-2026-75838 [MEDIUM] CVE-2026-75838 fbthrift: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
CVE-2026-75838 fbthrift: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Bugzilla
CVE-2026-75838 cachelib: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
bugzilla·2026-09-17·CVSS 5.1
CVE-2026-75838 [MEDIUM] CVE-2026-75838 cachelib: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
CVE-2026-75838 cachelib: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Bugzilla
CVE-2026-75838 nextcloud: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
bugzilla·2026-09-17·CVSS 5.1
CVE-2026-75838 [MEDIUM] CVE-2026-75838 nextcloud: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
CVE-2026-75838 nextcloud: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Bugzilla
CVE-2026-75838 jupyterlab: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
bugzilla·2026-09-17·CVSS 5.1
CVE-2026-75838 [MEDIUM] CVE-2026-75838 jupyterlab: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
CVE-2026-75838 jupyterlab: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Bugzilla
CVE-2026-75838 forgejo: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
bugzilla·2026-09-17·CVSS 5.1
CVE-2026-75838 [MEDIUM] CVE-2026-75838 forgejo: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
CVE-2026-75838 forgejo: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Bugzilla
CVE-2026-75838 nextcloud: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
bugzilla·2026-09-17·CVSS 5.1
CVE-2026-75838 [MEDIUM] CVE-2026-75838 nextcloud: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
CVE-2026-75838 nextcloud: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Bugzilla
CVE-2026-75838 openbao: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
bugzilla·2026-09-17·CVSS 5.1
CVE-2026-75838 [MEDIUM] CVE-2026-75838 openbao: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
CVE-2026-75838 openbao: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Discussion:
OpenBao has no server-side javascript so this vulnerability is not applicable
Bugzilla
CVE-2026-75838 cachelib: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
bugzilla·2026-09-17·CVSS 5.1
CVE-2026-75838 [MEDIUM] CVE-2026-75838 cachelib: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
CVE-2026-75838 cachelib: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Bugzilla
CVE-2026-75838 forgejo: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
bugzilla·2026-09-17·CVSS 5.1
CVE-2026-75838 [MEDIUM] CVE-2026-75838 forgejo: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
CVE-2026-75838 forgejo: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Bugzilla
CVE-2026-75838 fbthrift: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
bugzilla·2026-09-17·CVSS 5.1
CVE-2026-75838 [MEDIUM] CVE-2026-75838 fbthrift: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
CVE-2026-75838 fbthrift: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Bugzilla
CVE-2026-75838 jupyterlab: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
bugzilla·2026-09-17·CVSS 5.1
CVE-2026-75838 [MEDIUM] CVE-2026-75838 jupyterlab: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
CVE-2026-75838 jupyterlab: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Bugzilla
CVE-2026-75838 dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization
bugzilla·2026-08-18·CVSS 5.1
CVE-2026-75838 [MEDIUM] CVE-2026-75838 dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization
CVE-2026-75838 dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
2026-08-18
Published