CVE-2026-109345: DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root
DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because INPLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the returned node.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DOMPurifyto a version that resolves this vulnerability.Fixed in 3.4.16
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using the npm dompurify package before version 3.4.16 are exposed when they use IN_PLACE mode and later serialize and re-parse the returned node. The issue requires attacker-controlled HTML to reach that sanitization flow.
What does an attacker need to do to trigger script execution?
An attacker must supply a style element whose text includes a closing style tag followed by an img element with an onerror payload. Script execution occurs when the application serializes and then re-parses the node returned by DOMPurify.
Is user interaction required?
Yes. The supplied CVSS vector specifies UI:R, meaning user interaction is required. The vector also indicates that no attacker privileges are required and the issue can be reached over the network.
What is the remediation?
Upgrade DOMPurify to version 3.4.16 or later. If upgrading cannot happen immediately, avoid using IN_PLACE mode for attacker-controlled HTML and do not serialize and re-parse nodes returned from that mode.