{"id":"CVE-2026-109345","title":"DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup","summary":"DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply …","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"cure53","product":"DOMPurify","affected":["DOMPurify < 3.4.16"],"published":"2026-10-12","updated":"2026-10-16","sourceUpdated":"2026-10-16T17:27:24.847","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109345","references":[{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-6688-9rhm-gjv2","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/dompurify-before-3.4.16-xss-via-in-place-returned-rawtext-root","label":"disclosure@vulncheck.com"},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-6688-9rhm-gjv2","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-109345.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-109345"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2549763"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-109345"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109345"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"epss":0.0025,"epssPercentile":0.16239,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-13T17:39:41.683886Z"},"ingestedAt":"2026-10-12T18:00:08.209Z","slug":"CVE-2026-109345","body":"## Overview\n\nDOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the returned node.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-109345.json)","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":221033,"id":"CVE-2026-109345","ts":1792027015480,"field":"exploit_available","old":"false","new":"true"}]}