CVE-2026-75838CWE-79cross-site-scripting

CVE-2026-75838

published August 18, 2026

CVSS

5.1

EPSS

Percentile

21.6

In the wild

Unconfirmed

What it is

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

The record

Technical detail

CVSS: 5.1 · NONE
CVSS v4.0: 5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS: 0.00300 · 21.6th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2026-08-18T16:19Z

References (3)

https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7 · [email protected]https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook · [email protected]https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

18 AUG 11:19Z
DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook
cvelistv5