CVE-2026-109344

DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because INPLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on handlers inside a wrapper removed by such hooks, leaving...

CVE-2026-109344 DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks

DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because INPLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on handlers inside a wrapper removed by such hooks, leaving...

EUVD-2026-97646

DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because INPLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on handlers inside a wrapper removed by such hooks, leaving...

CVE-2026-109344

The DOMPurify library, versions 3.4.13 before 3.4.16 , is vulnerable to a DOM-based Cross-Site Scripting (XSS) vulnerability. The root cause is that IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. An attacker can provide markup contai...

PT-2026-110761

DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on handlers inside a wrapper removed by such hooks, leaving...

Cross-site Scripting (XSS)

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS in sanitizeElements and sanitizeAttributes in src/purify.ts, which invoke handleHookDetachedNode only after the beforeSanitizeElements and...

Cross-site Scripting (XSS)

Overview org.webjars.npm:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS in sanitizeElements and sanitizeAttributes in src/purify.ts, which invoke handleHookDetachedNode only after the...

Security Bulletin: IBM DataPower Gateway affected by cross-site scripting due to DOMPurify (CVE-2026-66010)

Summary IBM DataPower Gateway has addressed CVE-2026-66010 in 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-66010 DESCRIPTION: DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing...

Duplicate Advisory: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c2j3-45gr-mqc4. This link is maintained to preserve external references. Original Description DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via...

GHSA-JXRP-R7GX-Q4J8 Duplicate Advisory: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c2j3-45gr-mqc4. This link is maintained to preserve external references. Original Description DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via...

PT-2026-105528

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c2j3-45gr-mqc4. This link is maintained to preserve external references. Original Description DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM ELEMENT...

CVE-2026-66010: Improper Neutralization of Input During Web Page Generation

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into...

Incomplete List of Disallowed Inputs

Overview org.webjars.npm:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the CUSTOMELEMENTHANDLING. An attacker can cause security-relevant attributes to be preserved on allowed custom...