CVE-2026-109344: DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks
DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because INPLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on handlers inside a wrapper removed by such hooks, leaving handlers armed on the live DOM to execute script in the victim origin.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DOMPurifyto a version that resolves this vulnerability.Fixed in 3.4.16
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using DOMPurify versions 3.4.13 through 3.4.15 are exposed when they use IN_PLACE mode together with afterSanitizeElements or afterSanitizeAttributes hooks that detach subtrees. The issue concerns markup processed through that configuration.
What does an attacker need to exploit the vulnerability?
An attacker needs to be able to supply markup that is sanitized by the affected DOMPurify configuration. The supplied markup can contain on* event handlers inside a wrapper that an after-sanitization hook removes, and exploitation requires victim interaction.
What is the practical impact?
Event handlers can remain armed on the live DOM after the hook detaches their enclosing subtree. If triggered, they can execute script in the victim's origin.
How can I determine whether my application is affected?
Check whether your application uses DOMPurify 3.4.13, 3.4.14, or 3.4.15, invokes sanitize with IN_PLACE mode, and registers afterSanitizeElements or afterSanitizeAttributes hooks that remove or detach DOM subtrees. All of those conditions are relevant to this issue.
What can be done if upgrading is not immediately possible?
Avoid the affected combination of IN_PLACE mode and afterSanitizeElements or afterSanitizeAttributes hooks that detach subtrees. Update DOMPurify to version 3.4.16 or later when possible.