Medium severity · published Aug 18, 2026
CVE-2026-75838
DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook
5.1
CVSS
0.4%
EPSS
No
On KEV
Description
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
DOMPurify · cure53
before 3.4.13 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-75838
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-75838
github.com
https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7
www.vulncheck.com
https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook
More from DOMPurify
9.8
CVE-2024-48910
DOMPurify vulnerable to tampering by prototype polution
8.2
CVE-2026-47423
DOMPurify XSS via `selectedcontent` re-clone
7.5
CVE-2025-48050
In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory
7.2
CVE-2026-65898
DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig
6.9
CVE-2026-41238
DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback