{"id":"CVE-2026-109344","title":"DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks","summary":"DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on*…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"cure53","product":"DOMPurify","affected":["DOMPurify >= 3.4.13 < 3.4.16"],"published":"2026-10-12","updated":"2026-10-16","sourceUpdated":"2026-10-16T17:27:24.847","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109344","references":[{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-p98j-92pf-mc4p","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/dompurify-from-3.4.13-before-3.4.16-dom-xss-via-in-place-aftersanitize-hooks","label":"disclosure@vulncheck.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-109344.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-109344"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2549751"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-109344"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109344"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00188,"epssPercentile":0.08354,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-13T16:22:10.525306Z"},"ingestedAt":"2026-10-12T18:00:08.209Z","slug":"CVE-2026-109344","body":"## Overview\n\nDOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on* handlers inside a wrapper removed by such hooks, leaving handlers armed on the live DOM to execute script in the victim origin.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-109344.json)","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}