Vulnerabilities CVE-2026-75838

CVE-2026-75838

Medium

Open

TLP:CLEAR

DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

Details

CVSS Score: 5.1
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Confidence: 90%
Published: Aug 18, 2026
Last Modified: Aug 18, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.