CVE-2026-116803

A flaw was found in DOMPurify. This vulnerability allows a remote attacker to conduct cross-site scripting XSS attacks by supplying specially crafted markup. When an application processes content using in-place sanitization hooks that remove surrounding elements, the library fails to neutralize...

DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

Summary During INPLACE sanitization, a hook that removes an element can leave that element's detached descendants executable. A descendant image can retain its attacker-provided onload handler and fire after sanitize returns, even though the returned root is clean and the image remains disconnect...