p PatchFirst

CVE-2026-75838

CVE-2026-75838 · DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

This page contains facts from public vulnerability sources. Check the original advisory before updating.

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

CVSS 5.1 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • dompurify

    Versions
    • ≥ 0, < 3.4.13: Affected (semver)
    • 3.4.13: Not affected (semver)

    Update to 3.4.13

  • node-dompurify Debian:12

    Versions
    • 2.4.1+dfsg+~2.4.0-1
    • 2.4.1+dfsg+~2.4.0-2
    • 2.4.1+dfsg+~2.4.0-2+deb12u1
    • 3.0.9+dfsg+~3.0.5-1
    • 3.1.6+dfsg+~3.0.5-1
    • 3.1.7+dfsg+~3.0.5-1
    • 3.1.7+dfsg+~3.0.5-2
    • 3.2.5+dfsg-1
    • 3.3.2+dfsg-1
    • 3.3.3+dfsg-1
    • 3.3.3+dfsg-2
    • 3.4.1+dfsg-1
    • 3.4.12+dfsg-1
    • 3.4.13+dfsg-1
    • 3.4.13+dfsg-2
    • 3.4.16+dfsg-1
    • 3.4.2+dfsg-1
    • 3.4.5+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-dompurify Debian:13

    Versions
    • 3.1.7+dfsg+~3.0.5-2
    • 3.2.5+dfsg-1
    • 3.3.2+dfsg-1
    • 3.3.3+dfsg-1
    • 3.3.3+dfsg-2
    • 3.4.1+dfsg-1
    • 3.4.12+dfsg-1
    • 3.4.13+dfsg-1
    • 3.4.13+dfsg-2
    • 3.4.16+dfsg-1
    • 3.4.2+dfsg-1
    • 3.4.5+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-dompurify Debian:14

    Versions
    • 3.1.7+dfsg+~3.0.5-2
    • 3.2.5+dfsg-1
    • 3.3.2+dfsg-1
    • 3.3.3+dfsg-1
    • 3.3.3+dfsg-2
    • 3.4.1+dfsg-1
    • 3.4.12+dfsg-1
    • 3.4.2+dfsg-1
    • 3.4.5+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 3.4.13+dfsg-1

    Update to 3.4.13+dfsg-1

  • dompurify npm

    Affected ranges
    • SEMVER: < 3.4.13

    Update to 3.4.13

  • node-dompurify Ubuntu:22.04:LTS

    Versions
    • 2.3.0+dfsg-2
    • 2.3.3+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-dompurify Ubuntu:24.04:LTS

    Versions
    • 2.4.1+dfsg+~2.4.0-1
    • 3.0.9+dfsg+~3.0.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-dompurify Ubuntu:26.10

    Versions
    • 3.3.3+dfsg-1
    • 3.4.2+dfsg-1
    • 3.4.5+dfsg-1
    • 3.4.12+dfsg-1
    • 3.4.13+dfsg-1
    • 3.4.13+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-dompurify Ubuntu:26.04:LTS

    Versions
    • 3.1.7+dfsg+~3.0.5-2
    • 3.3.3+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →