{"id":"CVE-2026-116803","kind":"vulnerability","aliases":["CVE-2026-116803"],"related":[],"title":"DOMPurify: IN_PLACE hook removal leaves event handlers active, enabling XSS","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.","summary":"DOMPurify before 3.4.17 fails to neutralize markup in detached subtrees when an IN_PLACE hook removes a parent or sibling node. Attacker-supplied handlers such as img onerror still fire after sanitize() returns, giving the attacker DOM-based cross-site scripting.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","dompurify","frontend","javascript","package"],"not_affected_if":["no-in-place-hooks","version-3.4.17-or-later"],"how_to_check":"- Check the installed version with `npm ls dompurify` or by reading `node_modules/dompurify/package.json`\n- Search the codebase for `IN_PLACE` hooks used with `DOMPurify.sanitize`","fix":"- Upgrade DOMPurify to `3.4.17` or later\n- Rebuild and redeploy front-end bundles that include DOMPurify","status":"open","published_at":"2026-10-27T00:17:11+00:00","first_seen_at":"2026-10-27T00:25:55+00:00","triaged_at":"2026-10-27T00:26:37+00:00","updated_at":"2026-10-27T00:26:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T00:26:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade DOMPurify to `3.4.17` or later\n- Rebuild and redeploy front-end bundles that include DOMPurify","reach":"internet","title":"DOMPurify: IN_PLACE hook removal leaves event handlers active, enabling XSS","impact":"high","summary":"DOMPurify before 3.4.17 fails to neutralize markup in detached subtrees when an IN_PLACE hook removes a parent or sibling node. Attacker-supplied handlers such as img onerror still fire after sanitize() returns, giving the attacker DOM-based cross-site scripting.","category":"package","nicknames":[],"who_cares":["javascript","frontend","dompurify","browser"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker script runs in victim's browser session, reading or acting as user","analyst_note":"Confirm the exact trigger conditions and whether the fix commit or advisory names the affected hook pattern; the NVD entry alone does not list them.","how_to_check":"- Check the installed version with `npm ls dompurify` or by reading `node_modules/dompurify/package.json`\n- Search the codebase for `IN_PLACE` hooks used with `DOMPurify.sanitize`","needs_analyst":true,"not_affected_if":["version-3.4.17-or-later","no-in-place-hooks"],"who_is_affected":"Applications that run DOMPurify in a browser or other DOM environment on untrusted HTML and use an IN_PLACE hook that can remove nodes are exposed. Projects on DOMPurify 3.4.17 or later, or that never register IN_PLACE hooks, can skip this.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000642,"input_tokens":3341,"output_tokens":615,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116803':14A,17A '-2026':13A,16A '3.4.17':25B,69C 'activ':9A 'allow':78C 'arm':84C 'attack':45B,59B,79C,96C 'attacker-suppli':44B 'base':62B 'browser':18B 'caus':115C 'contain':70C 'cross':64B,73C 'cross-sit':63B,72C 'cve':12A,15A 'detach':31B,99C 'dom':61B,116C 'dom-bas':60B 'dompurifi':1A,19B,23B,67C 'enabl':10A 'event':7A,82C 'fail':26B 'fire':53B,111C 'frontend':20B 'give':57B 'handler':8A,47B,83C,107C 'hook':4A,37B,89C 'img':50B,109C 'javascript':21B 'keep':81C 'leav':6A 'like':108C 'markup':29B,97C 'neutral':28B,105C 'never':102C 'node':43B,95C 'onerror':51B,110C 'packag':22B 'parent':40B,92C 'place':3A,36B,88C 'remov':5A,38B,90C 'return':56B,114C 'sanit':55B,113C 'script':66B,75C 'sibl':42B,94C 'site':65B,74C 'still':52B 'subtre':32B,100C 'suppli':46B 'vulner':76C 'walk':103C 'xss':11A,117C","nicknames":[],"mitigations":[],"who_affected":"Applications that run DOMPurify in a browser or other DOM environment on untrusted HTML and use an IN_PLACE hook that can remove nodes are exposed. Projects on DOMPurify 3.4.17 or later, or that never register IN_PLACE hooks, can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116803","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116803","severity":null,"published_at":"2026-10-27T00:17:11+00:00","modified_at":"2026-10-27T00:17:11+00:00","first_seen_at":"2026-10-27T00:25:55+00:00","fetched_at":"2026-10-27T00:25:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}