DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-75838 · Microsoft / collected KEV context

EUVD-2026-60602

GHSA-748c-f84h-hp2v

GHSA-55q2-fjhq-7xh7

cve-program · CVE-2026-75838

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7
• https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook

euvd · EUVD-2026-60602

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7
• https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook

nvd · CVE-2026-75838

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7
• https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook

osv · GHSA-55q2-fjhq-7xh7

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7
• https://github.com/cure53/DOMPurify/pull/1557
• https://github.com/cure53/DOMPurify/commit/3067f7746769
• https://github.com/cure53/DOMPurify
• https://github.com/cure53/DOMPurify/releases/tag/3.4.13

• DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execu… · Advisory content revised · 7 Nov 2026
• DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execu… · Advisory content revised · 1 Nov 2026