DEBIAN-CVE-2026-75838

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in INPLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned...

CVE-2026-75838

DOMPurify before 3.4.13 is affected by a cross-site scripting (XSS) vulnerability in its IN_PLACE sanitization mode. The root cause is that element-removal hooks fail to neutralize detached subtrees , allowing an attacker to supply HTML with event handlers on descendant elements that execute afte...