CVE-2026-109345: DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root

Q: Which applications are exposed to this issue?

Applications using the npm dompurify package before version 3.4.16 are exposed when they use IN_PLACE mode and later serialize and re-parse the returned node. The issue requires attacker-controlled HTML to reach that sanitization flow.

Q: What does an attacker need to do to trigger script execution?

An attacker must supply a style element whose text includes a closing style tag followed by an img element with an onerror payload. Script execution occurs when the application serializes and then re-parses the node returned by DOMPurify.

Q: Is user interaction required?

Yes. The supplied CVSS vector specifies UI:R, meaning user interaction is required. The vector also indicates that no attacker privileges are required and the issue can be reached over the network.

Q: What is the remediation?

Upgrade DOMPurify to version 3.4.16 or later. If upgrading cannot happen immediately, avoid using IN_PLACE mode for attacker-controlled HTML and do not serialize and re-parse nodes returned from that mode.

Published Oct 12, 2026

Updated

DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because INPLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the returned node.

Affected Software

1 affected component

npm/dompurify<3.4.16

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade DOMPurify to a version that resolves this vulnerability.
Fixed in 3.4.16

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using the npm dompurify package before version 3.4.16 are exposed when they use IN_PLACE mode and later serialize and re-parse the returned node. The issue requires attacker-controlled HTML to reach that sanitization flow.

What does an attacker need to do to trigger script execution?

An attacker must supply a style element whose text includes a closing style tag followed by an img element with an onerror payload. Script execution occurs when the application serializes and then re-parses the node returned by DOMPurify.

Is user interaction required?

Yes. The supplied CVSS vector specifies UI:R, meaning user interaction is required. The vector also indicates that no attacker privileges are required and the issue can be reached over the network.

What is the remediation?

Upgrade DOMPurify to version 3.4.16 or later. If upgrading cannot happen immediately, avoid using IN_PLACE mode for attacker-controlled HTML and do not serialize and re-parse nodes returned from that mode.

CVE-2026-109345: DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to do to trigger script execution?

Is user interaction required?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to do to trigger script execution?

Is user interaction required?

What is the remediation?