CVE-2026-109344

LOWCVSS 5.1 · MEDIUM

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on* handlers inside a wrapper removed by such hooks, leaving handlers armed on the live DOM to execute script in the victim origin.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://github.com/cure53/DOMPurify/security/advisories/GHSA-p98j-92pf-mc4p
https://www.vulncheck.com/advisories/dompurify-from-3.4.13-before-3.4.16-dom-xss-via-in-place-aftersanitize-hooks

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post

DailyCVE@dailycve1d
🔵 DOMPurify, Cross-Site Scripting, #CVE-2026-109344 (Low) -DC-Oct2026-3628 https://dailycve.com/dompurify-cross-site-scripting-cve-2026-109344-low-dc-oct2026-3628/
0000023
243 followersView on X

Explore more

Back to dashboard