1424 matches found
CVE-2026-109345
DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because INPLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img...
CVE-2026-109344
DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because INPLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on handlers inside a wrapper removed by such hooks, leaving...
UBUNTU-CVE-2026-109344
DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because INPLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on handlers inside a wrapper removed by such hooks, leaving...
UBUNTU-CVE-2026-109345
DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because INPLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img...
CVE-2026-109345
DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because INPLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img...
CLSA-2026-1791821569 TuxCare security update for dompurify (1 CVE)
TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.7-tuxcare.1...
CLSA-2026-1791821442 TuxCare security update for dompurify (1 CVE)
TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.3.3-tuxcare.1...
CLSA-2026-1791821318 TuxCare security update for dompurify (1 CVE)
TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.2-tuxcare.1...
CVE-2026-109345 DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root
DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because INPLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img...
CVE-2026-109344 DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks
DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because INPLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on handlers inside a wrapper removed by such hooks, leaving...
CVE-2026-109344 DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks
DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because INPLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on handlers inside a wrapper removed by such hooks, leaving...
9router-pro (0.5.109-pro.11), @a11d/lit-monaco-editor (>=0.0.1, <=0.1.2) +627 more potentially affected by CVE-2026-109344 via dompurify (>=3.4.13, <=3.4.15)
dompurify NPM version =3.4.13, =0.0.1, =6.4.45, =0.13.1, =5.52.1-fa.2, =5.52.1-fa.2, =0.0.0-canary.3862684, =1.0.0-beta.20250128110837, =1.0.0-beta.20260115134506 and more Source cves: CVE-2026-109344 Source advisory: MEND:CVE-2026-109344...
9router-pro (0.5.109-pro.11), @_sh/strapi-plugin-ckeditor (8.0.0) +1220 more potentially affected by CVE-2026-109345 via dompurify (>=3.4.0, <=3.4.15)
dompurify NPM version =3.4.0, =0.0.1, =0.1.0, =0.10.2, =0.1.0-alpha.36, =0.1.0, =6.3.4, =0.1.0, =6.4.40, =0.13.1, =0.2.0, =5.52.1-fa.2, =5.52.1-fa.6 and more Source cves: CVE-2026-109345 Source advisory: MEND:CVE-2026-109345...
CVE-2026-109345 DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root
DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because INPLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img...
EUVD-2026-97647
DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because INPLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img...
CVE-2026-109345
DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because INPLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img...
EUVD-2026-97646
DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because INPLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on handlers inside a wrapper removed by such hooks, leaving...
CVE-2026-109344
DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because INPLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on handlers inside a wrapper removed by such hooks, leaving...
CVE-2026-109345
The DOMPurify library before version 3.4.16 contains a cross-site scripting (XSS) vulnerability. The root cause is that in IN_PLACE mode, the library returns a force-removed style element whose text content still contains markup. An attacker can exploit this by supplying a style element containin...
CVE-2026-109344
The DOMPurify library, versions 3.4.13 before 3.4.16 , is vulnerable to a DOM-based Cross-Site Scripting (XSS) vulnerability. The root cause is that IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. An attacker can provide markup contai...