CVE-2026-75838
Received Received - Intake

DOM Purify IN_PLACE Sanitization XSS via Detached Subtrees

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-75838
EUVD
EUVD-2026-60602

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dompurify dompurify to 3.4.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

DOMPurify before version 3.4.13 has a cross-site scripting vulnerability in its IN_PLACE sanitization feature. When hooks remove an element, detached descendant elements with malicious event handlers like onload are not neutralized and can execute after sanitization appears complete. The sanitized output looks clean but contains executable code.

Detection Guidance

To detect this vulnerability, check the installed version of DOMPurify. If your system uses versions 3.4.12 or earlier, it is vulnerable. Run: npm list dompurify or grep dompurify package.json to verify the version.

Impact Analysis

If you use DOMPurify versions before 3.4.13 with IN_PLACE sanitization enabled and custom hooks that remove elements, attackers could inject malicious HTML with event handlers. These handlers may execute in a user's browser after sanitization, potentially stealing data or performing unauthorized actions on their behalf.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations using vulnerable DOMPurify versions may face compliance violations if exploited.

Mitigation Strategies

Immediately upgrade DOMPurify to version 3.4.13 or later. If upgrading is not possible, disable the IN_PLACE sanitization mode or avoid using element-removal hooks that trigger this issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75838. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart