Fluid Attacks Database

Description

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel10	ceph	-	-
rpm rhel10	cockpit-image-builder	-	-
rpm rhel10	grafana	-	-
rpm rhel8	grafana	-	-
rpm rhel9	grafana	-	-
debian 12	node-dompurify	=2.4.1+dfsg+~2.4.0-1 \|\| =2.4.1+dfsg+~2.4.0-2 \|\| =2.4.1+dfsg+~2.4.0-2+deb12u1 \|\| =3.0.9+dfsg+~3.0.5-1 \|\| =3.1.6+dfsg+~3.0.5-1 \|\| =3.1.7+dfsg+~3.0.5-1 \|\| =3.1.7+dfsg+~3.0.5-2 \|\| =3.2.5+dfsg-1 \|\| =3.3.2+dfsg-1 \|\| =3.3.3+dfsg-1 \|\| =3.3.3+dfsg-2 \|\| =3.4.1+dfsg-1 \|\| =3.4.12+dfsg-1 \|\| =3.4.13+dfsg-1 \|\| =3.4.13+dfsg-2 \|\| =3.4.2+dfsg-1 \|\| =3.4.5+dfsg-1	-
debian 13	node-dompurify	=3.1.7+dfsg+~3.0.5-2 \|\| =3.2.5+dfsg-1 \|\| =3.3.2+dfsg-1 \|\| =3.3.3+dfsg-1 \|\| =3.3.3+dfsg-2 \|\| =3.4.1+dfsg-1 \|\| =3.4.12+dfsg-1 \|\| =3.4.13+dfsg-1 \|\| =3.4.13+dfsg-2 \|\| =3.4.2+dfsg-1 \|\| =3.4.5+dfsg-1	-
debian 14	node-dompurify	=3.1.7+dfsg+~3.0.5-2 \|\| =3.2.5+dfsg-1 \|\| =3.3.2+dfsg-1 \|\| =3.3.3+dfsg-1 \|\| =3.3.3+dfsg-2 \|\| =3.4.1+dfsg-1 \|\| =3.4.12+dfsg-1 \|\| =3.4.2+dfsg-1 \|\| =3.4.5+dfsg-1 \|\| >=0 <3.4.13+dfsg-1	3.4.13+dfsg-1
npm	dompurify	>=0 <3.4.13	3.4.13

Aliases

1. CVE-2026-758382. NVD-2026-758383. OSV-2026-758384. OSV-DEBIAN-2026-758385. OSV-GHSA-55q2-fjhq-7xh76. GHSA-55q2-fjhq-7xh77. GCVE-2026-758388. SECURITY-TRACKER-CVE-2026-75838

References

1. https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh72. https://github.com/cure53/DOMPurify/pull/15573. https://github.com/cure53/DOMPurify/commit/3067f77467694. https://github.com/cure53/DOMPurify/releases/tag/3.4.13

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.