{"id":"EUVD-2026-97646","enisaUuid":"0173c4b1-4526-3b11-8714-64e27df09370","description":"DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on* handlers inside a wrapper removed by such hooks, leaving handlers armed on the live DOM to execute script in the victim origin.","datePublished":"Oct 12, 2026, 4:05:29 PM","dateUpdated":"Oct 13, 2026, 4:53:48 PM","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-p98j-92pf-mc4p\nhttps://www.vulncheck.com/advisories/dompurify-from-3.4.13-before-3.4.16-dom-xss-via-in-place-aftersanitize-hooks\n","aliases":"CVE-2026-109344\nGHSA-59fh-8xxf-p69h\n","assigner":"VulnCheck","epss":0.19,"enisaIdProduct":[{"id":"3992417b-1324-346e-b113-36a10abfcef2","product":{"name":"DOMPurify","vendor":{"name":"cure53"}},"product_version":"3.4.13 \u003c3.4.16"}],"enisaIdVendor":[{"id":"6ffcb6ee-a14c-3a4f-a980-929f3c5678c0","vendor":{"name":"cure53"}}],"enisaIdVulnerability":[{"id":"d0201eb3-6279-311f-b365-8c350d1695d1","vulnerability":{"id":"GHSA-59fh-8xxf-p69h","description":"DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on* handlers inside a wrapper removed by such hooks, leaving handlers armed on the live DOM to execute script in the victim origin.","datePublished":"Oct 12, 2026, 6:31:51 PM","dateUpdated":"Oct 12, 2026, 6:31:51 PM","baseScore":0.0,"references":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-p98j-92pf-mc4p\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-109344\nhttps://www.vulncheck.com/advisories/dompurify-from-3.4.13-before-3.4.16-dom-xss-via-in-place-aftersanitize-hooks\n","enisa_id":"EUVD-2026-97646\n","aliases":"CVE-2026-109344\nGHSA-59fh-8xxf-p69h\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e0a94912-9edc-3b03-8443-4d4d2f093987","vulnerability":{"id":"CVE-2026-109344","description":"DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on* handlers inside a wrapper removed by such hooks, leaving handlers armed on the live DOM to execute script in the victim origin.","datePublished":"Oct 12, 2026, 4:05:29 PM","dateUpdated":"Oct 13, 2026, 4:53:48 PM","status":"PUBLISHED","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-p98j-92pf-mc4p\nhttps://www.vulncheck.com/advisories/dompurify-from-3.4.13-before-3.4.16-dom-xss-via-in-place-aftersanitize-hooks\n","enisa_id":"EUVD-2026-97646\n","assigner":"VulnCheck","epss":0.19,"dataProcessed":"Nov 4, 2026, 7:17:04 AM","vulnerabilityProduct":[{"id":"4fd8d5b9-69e8-365b-9bf4-01af0a403b2a","product":{"name":"DOMPurify","vendor":{"name":"cure53"}},"product_version":"3.4.13 \u003c3.4.16"}],"vulnerabilityVendor":[{"id":"aa4e4799-113f-3d57-9a62-7c331f20f642","vendor":{"name":"cure53"}}]}}],"enisaIdAdvisory":[]}