Live › vulnerability › CVE-2026-116803
Go to dashboardDOMPurify before 3.4.17 fails to neutralize markup in detached subtrees when an IN_PLACE hook removes a parent or sibling node. Attacker-supplied handlers such as img onerror still fire after sanitize() returns, giving the attacker DOM-based cross-site scripting.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Applications that run DOMPurify in a browser or other DOM environment on untrusted HTML and use an IN_PLACE hook that can remove nodes are exposed. Projects on DOMPurify 3.4.17 or later, or that never register IN_PLACE hooks, can skip this.
No product ranges from the sources yet.
npm ls dompurify or by reading node_modules/dompurify/package.jsonIN_PLACE hooks used with DOMPurify.sanitize3.4.17 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.
This page as .md · .json · in your agent: get_signal("CVE-2026-116803")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.