Medium severity · published Aug 18, 2026
CVE-2026-75838
DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook
5.1
CVSS
0.4%
EPSS
No
On KEV
Description
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
DOMPurify · cure53
before 3.4.13 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-75838
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-75838
github.com
https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7
www.vulncheck.com
https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook
More from DOMPurify
9.8
CVE-2024-48910
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG
8.2
CVE-2026-47423
DOMPurify XSS via `selectedcontent` re-clone
7.2
CVE-2026-65898
DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig
6.9
CVE-2026-41238
DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback
6.8
CVE-2026-41239
DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode