CVE-2026-75838

Description

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

References

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7
• https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7