Security Bulletin: Vulnerability in DOMPurity affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in DOMPurity has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

Security Bulletin: IBM Test Accelerator for Z uses dompurify-3.4.13.tgz which is vulnerable to CVE-2026-109344, CVE-2026-109345

Summary Security Bulletin: IBM Test Accelerator for Z uses dompurify-3.4.13.tgz which is vulnerable to CVE-2026-109344, CVE-2026-109345. This security bulletin provides details about the vulnerability and the corresponding remediation. Vulnerability Details CVEID:CVE-2026-109344 DESCRIPTION:...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in dompurify(CVE-2026-109344, CVE-2026-109345)

Summary IBM Db2 Developer Extension is affected by vulnerability in dompurifyCVE-2026-109344, CVE-2026-109345 Vulnerability Details CVEID:CVE-2026-109344 DESCRIPTION: DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because INPLACE mode fails to neutralize subtree...

Security Bulletin: Carbon chart DOMPurify XSS Vulnerabilities (CVE-2026-109344, CVE-2026-109345)

Summary DOMPurify was updated to address two cross-site scripting vulnerabilities CVE-2026-109344, CVE-2026-109345 affecting versions prior to 3.4.16. Both vulnerabilities involve the INPLACE mode failing to fully neutralize malicious markup: CVE-2026-109344 leaves event handlers armed on the liv...

Linux Distros Unpatched Vulnerability : CVE-2026-116803

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an INPLACE hook removes a parent o...

CVE-2026-116803

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an INPLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize...

SUSE CVE-2026-116803

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an INPLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize...

SUSE CVE-2026-116804

DOMPurify from 3.4.4 before 3.4.17 contains a SAFEFORTEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURNDOM, RETURNDOMFRAGMENT, or INPLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which mer...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in DOMPurify (CVE-2026-65904, CVE-2026-65911)

Summary Multiple vulnerabilities in the DOMPurify library CVE-2026-65904, CVE-2026-65911 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 3.4.12 on Windows and version 3.4.13 on Linux. Vulnerability Details CVEID:CVE-2026-65904 DESCRIPTION:...

Cross-site Scripting (XSS)

Overview org.webjars.npm:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS via handleHookDetachedNode in src/purify.ts when INPLACE mode is used with a hook that removes a node other than the hook's own nod...

Cross-site Scripting (XSS)

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS via handleHookDetachedNode in src/purify.ts when INPLACE mode is used with a hook that removes a node other than the hook's own node such as a...

EUVD-2026-110511

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an INPLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize...

DEBIAN-CVE-2026-116804

DOMPurify from 3.4.4 before 3.4.17 contains a SAFEFORTEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURNDOM, RETURNDOMFRAGMENT, or INPLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which mer...

CVE-2026-116804

DOMPurify from 3.4.4 before 3.4.17 contains a SAFEFORTEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURNDOM, RETURNDOMFRAGMENT, or INPLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which mer...

CVE-2026-116803

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an INPLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize...

DEBIAN-CVE-2026-116803

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an INPLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize...

UBUNTU-CVE-2026-116803

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an INPLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize...

CVE-2026-116803

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an INPLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize...

UBUNTU-CVE-2026-116804

DOMPurify from 3.4.4 before 3.4.17 contains a SAFEFORTEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURNDOM, RETURNDOMFRAGMENT, or INPLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which mer...

Cure53 DOMPurify cross-site scripting vulnerability

Versions of Cure53 DOMPurify prior to 3.4.17 contain a cross-site scripting vulnerability. This vulnerability arises because after removing parent nodes or child nodes via the INPLACE hook, attackers within the subtree fail to traverse or neutralize the markers; as a result, event handlers such a...