Linux Distros Unpatched Vulnerability : CVE-2026-109345

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because INPLACE mode returns a force-removed...

DEBIAN-CVE-2026-109344

DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because INPLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on handlers inside a wrapper removed by such hooks, leaving...

CVE-2026-109345

DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because INPLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img...

EUVD-2026-97646

DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because INPLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on handlers inside a wrapper removed by such hooks, leaving...

dompurify: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName

A flaw was found in DOMPurify. This cross-site scripting XSS vulnerability exists in INPLACE mode, where the software trusts attacker-controlled nodeName on live non-form nodes. A remote attacker can supply hostile live Document Object Model DOM objects with script children. These scripts can...

dompurify: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName

A flaw was found in DOMPurify. This cross-site scripting XSS vulnerability exists in INPLACE mode, where the software trusts attacker-controlled nodeName on live non-form nodes. A remote attacker can supply hostile live Document Object Model DOM objects with script children. These scripts can...

CVE-2026-65904

A flaw was found in DOMPurify. When DOM elements originating from a different window or realm, such as an iframe's contentDocument, are processed in INPLACE mode, DOMPurify fails to properly sanitize them. This oversight allows an attacker to inject and execute Cross-Site Scripting XSS payloads,...

CVE-2026-65901

A flaw was found in DOMPurify. This cross-site scripting XSS vulnerability exists in INPLACE mode, where the software trusts attacker-controlled nodeName on live non-form nodes. A remote attacker can supply hostile live Document Object Model DOM objects with script children. These scripts can...

DOMPurify: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms

A flaw was found in DOMPurify. When DOM elements originating from a different window or realm, such as an iframe's contentDocument, are processed in INPLACE mode, DOMPurify fails to properly sanitize them. This oversight allows an attacker to inject and execute Cross-Site Scripting XSS payloads,...

Improper Check for Unusual or Exceptional Conditions

Overview org.webjars.npm:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions in the INPLACE process when DOM elements are passed from a different window or realm, such as an iframe...

CVE-2026-65901

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in INPLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements,...

CVE-2026-65904

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's contentDocument. A cross-realm instanceof check in the private isNode function returns false for foreign-realm nodes, causing DOMPurify to...

CVE-2026-65901: Improper Neutralization of Input During Web Page Generation

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in INPLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements,...

CVE-2026-65904: Improper Check for Unusual or Exceptional Conditions

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's contentDocument. A cross-realm instanceof check in the private isNode function returns false for foreign-realm nodes, causing DOMPurify to...