{"id":"EUVD-2026-110511","enisaUuid":"7ba821d2-7bb7-3479-a925-c3a79425446c","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.","datePublished":"Oct 26, 2026, 11:05:35 PM","dateUpdated":"Oct 26, 2026, 11:05:35 PM","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-mrv2-3pqr-j5jr\nhttps://www.vulncheck.com/advisories/dompurify-before-3.4.17-dom-xss-via-in-place-hook-detached-subtrees\n","aliases":"CVE-2026-116803\nGHSA-77h4-4vqj-j7vc\n","assigner":"VulnCheck","epss":0.0,"enisaIdProduct":[{"id":"90d5ad92-84c6-361b-8318-be7ee96a0c61","product":{"name":"DOMPurify","vendor":{"name":"cure53"}},"product_version":"0 \u003c3.4.17"}],"enisaIdVendor":[{"id":"07013560-2795-3d85-a83f-8f1a06e26820","vendor":{"name":"cure53"}}],"enisaIdVulnerability":[{"id":"35099e48-60d3-3122-8a53-9f7045a431bf","vulnerability":{"id":"CVE-2026-116803","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.","datePublished":"Oct 26, 2026, 11:05:35 PM","dateUpdated":"Oct 26, 2026, 11:05:35 PM","status":"PUBLISHED","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-mrv2-3pqr-j5jr\nhttps://www.vulncheck.com/advisories/dompurify-before-3.4.17-dom-xss-via-in-place-hook-detached-subtrees\n","enisa_id":"EUVD-2026-110511\n","assigner":"VulnCheck","epss":0.0,"dataProcessed":"Oct 28, 2026, 2:00:25 AM","vulnerabilityProduct":[{"id":"47e4fca6-dcd2-3277-8a49-c93751483e97","product":{"name":"DOMPurify","vendor":{"name":"cure53"}},"product_version":"0 \u003c3.4.17"}],"vulnerabilityVendor":[{"id":"df77fdce-58b7-39bf-949f-2bd4c5063c69","vendor":{"name":"cure53"}}]}},{"id":"63ccf41e-7d8e-3ffb-9216-90f5dc3008d3","vulnerability":{"id":"GHSA-77h4-4vqj-j7vc","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.","datePublished":"Oct 27, 2026, 12:32:50 AM","dateUpdated":"Oct 27, 2026, 12:32:50 AM","baseScore":0.0,"references":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-mrv2-3pqr-j5jr\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116803\nhttps://www.vulncheck.com/advisories/dompurify-before-3.4.17-dom-xss-via-in-place-hook-detached-subtrees\n","enisa_id":"EUVD-2026-110511\n","aliases":"GHSA-77h4-4vqj-j7vc\nCVE-2026-116803\n","epss":0.0,"dataProcessed":"Oct 28, 2026, 2:02:34 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}