CVE-2026-75838: DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in INPLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DOMPurifyto a version that resolves this vulnerability.Fixed in 3.4.13 - Compensating control
If you cannot immediately upgrade, avoid IN_PLACE sanitization (since the vulnerability is in DOMPurify before 3.4.13 for IN_PLACE where element-removal hooks fail to neutralize detached subtrees).
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using npm/dompurify versions before 3.4.13 are affected when they use IN_PLACE sanitization together with element-removal hooks. The issue concerns sanitized HTML containing descendant elements with event handlers in detached subtrees.
What attacker-controlled input or application behavior is required for exploitation?
An attacker needs to be able to supply HTML that the application sanitizes through the affected IN_PLACE and element-removal-hook flow. Event handlers on descendant elements can then execute after sanitization, despite the returned root appearing clean.