PT-2026-76938

CVE-2026-75838

Published

2026-08-07

Updated

2026-10-22

Description by

CVSS 4.0

5.1

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.4.13

Description An issue exists in the IN PLACE sanitization process where element-removal hooks do not properly neutralize detached subtrees. This allows attackers to provide HTML containing event handlers on descendant elements that execute after the sanitization process is finished, despite the returned root element appearing clean. This leads to cross-site scripting, a technique where malicious scripts are injected into trusted websites.

Recommendations Update to version 3.4.13 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Koyokr

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers