VULNERABILITY INTELLIGENCE
CVE-2026-75838
CVSS score5.1 MEDIUM
EPSS probability0.39%
CISA KEVNot currently listed
Published2026-08-18
Last modified2026-10-22
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Description
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Weakness classification
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')