DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-116803 · Microsoft / collected KEV context

EUVD-2026-110511

GHSA-77h4-4vqj-j7vc

GHSA-mrv2-3pqr-j5jr

cve-program · CVE-2026-116803

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-mrv2-3pqr-j5jr
• https://www.vulncheck.com/advisories/dompurify-before-3.4.17-dom-xss-via-in-place-hook-detached-subtrees

euvd · EUVD-2026-110511

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-mrv2-3pqr-j5jr
• https://www.vulncheck.com/advisories/dompurify-before-3.4.17-dom-xss-via-in-place-hook-detached-subtrees

nvd · CVE-2026-116803

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-mrv2-3pqr-j5jr
• https://www.vulncheck.com/advisories/dompurify-before-3.4.17-dom-xss-via-in-place-hook-detached-subtrees

osv · GHSA-mrv2-3pqr-j5jr

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-mrv2-3pqr-j5jr
• https://github.com/cure53/DOMPurify/pull/1672
• https://github.com/cure53/DOMPurify/commit/a77a3e78b59f72fa4d1c83f22e121ad9cc7d3575
• https://github.com/cure53/DOMPurify
• https://github.com/cure53/DOMPurify/releases/tag/3.4.17

• DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutral… · Advisory content revised · 29 Oct 2026
• DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees · Newly collected advisory · 27 Oct 2026
• DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p) · Advisory content revised · 27 Oct 2026