Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.1

DOMPurify before 3.4.17 may let malicious code run

CVE-2026-116803 · published 9 days ago
Summary

The DOMPurify library versions earlier than 3.4.17 can fail to remove hidden malicious code when it removes parts of a page. This means that specially crafted web content could still execute unwanted scripts after the cleaning process finishes. Upgrade to version 3.4.17 or later to ensure all unsafe code is properly removed.

Original advisory text
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in d...
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published27 Oct 2026
Updated31 Oct 2026
First seen27 Oct 2026
Sources
CVE-2026-116803 · NVD
Track software like this
Free during beta