{"id":"EUVD-2026-97647","enisaUuid":"d8345023-f06c-322a-8d12-d97a1db14ac0","description":"DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the returned node.","datePublished":"Oct 12, 2026, 4:05:29 PM","dateUpdated":"Oct 13, 2026, 5:40:08 PM","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-6688-9rhm-gjv2\nhttps://www.vulncheck.com/advisories/dompurify-before-3.4.16-xss-via-in-place-returned-rawtext-root\n","aliases":"CVE-2026-109345\nGHSA-cjhx-p48c-gfm9\n","assigner":"VulnCheck","epss":0.25,"enisaIdProduct":[{"id":"44d631f3-0481-3682-bec9-e375b3ed8fbd","product":{"name":"DOMPurify","vendor":{"name":"cure53"}},"product_version":"0 \u003c3.4.16"}],"enisaIdVendor":[{"id":"08c15284-5d70-3d33-9299-6c9aeebc5a74","vendor":{"name":"cure53"}}],"enisaIdVulnerability":[{"id":"6c9b46af-d233-3a0e-906f-6348243657e7","vulnerability":{"id":"GHSA-cjhx-p48c-gfm9","description":"DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the returned node.","datePublished":"Oct 12, 2026, 6:31:51 PM","dateUpdated":"Oct 12, 2026, 6:31:51 PM","baseScore":0.0,"references":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-6688-9rhm-gjv2\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-109345\nhttps://www.vulncheck.com/advisories/dompurify-before-3.4.16-xss-via-in-place-returned-rawtext-root\n","enisa_id":"EUVD-2026-97647\n","aliases":"CVE-2026-109345\nGHSA-cjhx-p48c-gfm9\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"da4117c4-0aa7-3106-b8c4-1b6793044ec8","vulnerability":{"id":"CVE-2026-109345","description":"DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the returned node.","datePublished":"Oct 12, 2026, 4:05:29 PM","dateUpdated":"Oct 13, 2026, 5:40:08 PM","status":"PUBLISHED","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-6688-9rhm-gjv2\nhttps://www.vulncheck.com/advisories/dompurify-before-3.4.16-xss-via-in-place-returned-rawtext-root\n","enisa_id":"EUVD-2026-97647\n","assigner":"VulnCheck","epss":0.25,"dataProcessed":"Nov 1, 2026, 4:05:43 AM","vulnerabilityProduct":[{"id":"52328376-b1e5-33c8-8b90-456d7d0e21f4","product":{"name":"DOMPurify","vendor":{"name":"cure53"}},"product_version":"0 \u003c3.4.16"}],"vulnerabilityVendor":[{"id":"be0ba623-581b-38e0-87a4-2ea76a242798","vendor":{"name":"cure53"}}]}}],"enisaIdAdvisory":[]}