{"id":"CVE-2026-116803","title":"DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees","summary":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neut…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"cure53","product":"DOMPurify","affected":["DOMPurify < 3.4.17"],"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T23:05:35.135Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116803","references":[{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-mrv2-3pqr-j5jr","label":"GitHub Security Advisory (GHSA-mrv2-3pqr-j5jr)"},{"url":"https://www.vulncheck.com/advisories/dompurify-before-3.4.17-dom-xss-via-in-place-hook-detached-subtrees","label":"VulnCheck Advisory: DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees"}],"tags":["cve.org"],"epss":0.00164,"epssPercentile":0.05591,"ingestedAt":"2026-10-27T16:11:59.139Z","slug":"CVE-2026-116803","body":"## Overview\n\nDOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.\n\n## Affected\n\n- `DOMPurify < 3.4.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}