CVE-2026-109344
Received Received - Intake

DOM Purify XSS via Incomplete Hook Sanitization

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on* handlers inside a wrapper removed by such hooks, leaving handlers armed on the live DOM to execute script in the victim origin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109344
EUVD
EUVD-2026-97646

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cure53 DOMPurify 3.4.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in DOMPurify versions 3.4.13 to 3.4.16 allows cross-site scripting (XSS) attacks due to improper handling of detached subtrees in IN_PLACE mode. Attackers can inject markup with event handlers (like on*) inside a wrapper that gets removed by sanitization hooks. The handlers remain active on the live DOM and execute malicious scripts in the victim's browser.

Detection Guidance

This vulnerability affects DOMPurify versions 3.4.13 to 3.4.16. To detect it, check the installed version of DOMPurify in your system or application dependencies. If you are using a package manager like npm, run commands such as 'npm list dompurify' or 'npm list dompurify@3.4.13' to verify the version.

Impact Analysis

If you use a vulnerable version of DOMPurify, attackers could execute arbitrary JavaScript in your application's context. This could lead to session hijacking, data theft, or defacement of your website. Users' sensitive data or credentials might be compromised if they interact with the malicious payload.

Compliance Impact

This XSS vulnerability could violate GDPR's data protection requirements by enabling unauthorized access to user data. For HIPAA, it may compromise protected health information if medical data is exposed. Organizations must address this to maintain compliance with data security and privacy regulations.

Mitigation Strategies

Immediately upgrade DOMPurify to version 3.4.16 or later to address the vulnerability. If upgrading is not possible, consider disabling the IN_PLACE mode or implementing additional input validation and sanitization measures in your application to mitigate the risk of XSS attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109344. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart