Medium severityNVD Advisory· Published Aug 18, 2026

CVE-2026-75838

Description

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cure53/Dompurifyllm-create
Range: <3.4.13

Patches

Vulnerability mechanics

References

github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7nvd
www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hooknvd

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000