Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2026-109345

DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the returned node.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

cure53 DOMPurify

Default version status: unaffected

  • 0 to < 3.4.16affected
  • 3.4.16unaffected
pkg:npm/dompurify

References