CVE-2026-75838

Medium

Description

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

SeverityMedium

CVSS5.1

Exploit probability—

ProductDompurify

PublishedAug 18, 2026

First seenAug 18, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

dompurify3.4.13 or later

Vendor advisories

github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7

Affected products

Product	Affected versions	Fixed in
dompurifynpm	v < 3.4.13	3.4.13

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.