CVE-2026-109345
Received Received - Intake

DOM Purify XSS Bypass via Style Element Sanitization

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the returned node.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109345
EUVD
EUVD-2026-97647

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cure53 DOMPurify 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects DOMPurify versions before 3.4.16. When using IN_PLACE sanitization mode, a style element that should be removed retains its text content with malicious markup. Attackers can inject a style element with a closing tag and an img onerror payload. When the application serializes and re-parses the returned node, the payload executes as cross-site scripting (XSS).

Detection Guidance

To detect this vulnerability, inspect applications using DOMPurify versions 3.4.x up to 3.4.15. Check if IN_PLACE sanitization mode is used and if style elements or other rawtext nodes are returned after sanitization. Look for unexpected script execution in serialized or re-parsed content.

Impact Analysis

If you use DOMPurify versions before 3.4.16 in IN_PLACE mode, attackers could execute arbitrary JavaScript in your application. This could lead to session hijacking, data theft, or defacement. The impact depends on the application's context and user privileges.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may compromise protected health information integrity. Compliance risks include data breaches and failure to protect sensitive data.

Mitigation Strategies

Upgrade DOMPurify to version 3.4.16 or later. Avoid using IN_PLACE mode if possible. If IN_PLACE is required, implement additional validation to ensure removed nodes do not contain malicious markup before serialization.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109345. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart