Vulnerability in cure53 DOMPurify

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• CERT-FR22 Oct 2026CERTFR-2026-AVI-1366

  Multiple vulnerabilities in Splunk products Translated from French

  Multiple vulnerabilities have been discovered in Splunk products. Some of them allow an attacker to cause arbitrary code execution, a breach of data confidentiality and remote cross-site scripting (XSS).

  CVE-2026-76298CVE-2026-42308CVE-2026-76295+108 more CVEs
• CERT-FR9 Oct 2026CERTFR-2026-AVI-1291

  Multiple vulnerabilities in IBM products Translated from French

  Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-49978CVE-2025-27895CVE-2026-59651+195 more CVEs
• CERT-FR2 Oct 2026CERTFR-2026-AVI-1256

  Multiple vulnerabilities in IBM products Translated from French

  Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-27980CVE-2026-58055CVE-2026-49978+360 more CVEs
• CERT-FR25 Sep 2026CERTFR-2026-AVI-1233

  Multiple vulnerabilities in IBM products Translated from French

  Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, remote denial of service and a breach of data confidentiality.

  CVE-2021-44906CVE-2026-59651CVE-2026-6402+183 more CVEs
• BSI CERT-Bund24 Sep 2026WID-SEC-2026-3572

  IBM i: Multiple vulnerabilities Translated from German

  CVE-2026-75838CVE-2026-84414

[ References ]References

• github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7vendor-advisory
• www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hookthird-party-advisory