CVE-2026-109344

Name of the Vulnerable Software and Affected Versions DOMPurify versions 3.4.13 through 3.4.15

Description DOMPurify contains a cross-site scripting (XSS) issue when used in IN PLACE mode. The library fails to neutralize subtrees that are detached by afterSanitizeElements or afterSanitizeAttributes hooks. An attacker can provide markup containing on* event handlers (such as onerror) inside a wrapper element. If a hook removes this wrapper, the descendant event handlers remain active on the live DOM instead of being stripped. This allows the execution of arbitrary scripts in the victim's origin when a queued resource event fires.

Recommendations Update DOMPurify to version 3.4.16. As a temporary workaround, avoid removing nodes inside afterSanitizeElements or afterSanitizeAttributes hooks and instead perform removals in beforeSanitizeElements or uponSanitizeElement hooks. As an alternative mitigation, avoid using IN PLACE mode for content influenced by attackers.