medium6.1
CVE-2026-116803
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent…
Impact
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.
Affected products
| Product | Affected versions |
|---|---|
| DOMPurify | before 3.4.17 |
Versions were read from the advisory text. No structured product data has been published for this record yet.