CVE-2026-75838 — DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can su…
Published: 2026-08-18 · CVSS: 5.1 · CVSS 4.0
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7