6.1
MediumCVSS 3.1 · from VulnCheck
CVE-2026-116803
DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees
DOMPurify · Cross-site scripting · CWE-79AffectedDOMPurify
FixUpdate to 3.4.17 or newer
PublishedOct 26, 23:05 · VulnCheck
ScoredOct 26 · 6.1 · VulnCheck
Exploit code publicNone known · checked 22:18 UTC
ExploitedNone known · CISA KEV checked 22:30 UTC
What we know
No known exploitation. CISA KEV, checked 22:30 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 22:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
Description
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inDOMPurifybefore 3.4.173.4.17DOMPurifyNot affected3.4.17
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known