CVE-2026-109344 in DOMPurify
Summary
by MITRE • 10/12/2026
DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on* handlers inside a wrapper removed by such hooks, leaving handlers armed on the live DOM to execute script in the victim origin.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in DOMPurify versions prior to 3.4.16 represents a critical failure in sanitization logic within its IN_PLACE execution mode. This library is widely utilized by web developers to sanitize HTML content, thereby preventing cross-site scripting attacks by stripping out dangerous elements and attributes from user-supplied markup. The core issue arises specifically when the sanitizer operates in IN_PLACE mode, which modifies the DOM nodes directly rather than returning a sanitized string or new node structure. In this operational context, the library relies on hook mechanisms such as afterSanitizeElements and afterSanitizeAttributes to allow for custom processing of elements after their initial sanitization pass. The flaw lies in how these hooks handle subtrees that are detached from the main document tree during execution. When a hook removes or detaches an element subtree, DOMPurify fails to recursively sanitize any remaining content within those detached nodes before they are potentially re-inserted into the live Document Object Model.
This technical deficiency allows attackers to craft malicious HTML payloads containing event handlers, such as onmouseover or onclick attributes, wrapped inside elements that are targeted for removal by these specific hooks. Because the sanitization process does not traverse and neutralize the internal content of detached subtrees, these dangerous script execution vectors remain intact within the DOM structure even after the outer wrapper has been removed. Consequently, when the sanitized output is rendered in a victim's browser, the embedded event handlers are active on live nodes that have now become part of the accessible document tree. This results in the immediate execution of arbitrary JavaScript code within the security context of the vulnerable website, effectively bypassing the intended protective barriers provided by the sanitizer.
The operational impact of this vulnerability is severe, as it directly facilitates Cross-Site Scripting attacks against end-users interacting with applications that rely on DOMPurify for input validation. An attacker can exploit this flaw to steal session cookies, hijack user accounts, perform actions on behalf of the victim, or deface the application interface. Since IN_PLACE mode is often used in scenarios where developers need to update existing DOM elements dynamically without replacing them entirely, such as in rich text editors or dynamic content loaders, the risk surface is significant. The attack does not require complex social engineering beyond standard XSS vectors; it simply requires injecting a specific HTML structure that triggers the hook-based detachment logic while preserving malicious attributes within the detached nodes.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. It also relates to CWE-829, where an insecure control is added to an executable, specifically referring to the addition of event handlers that allow script execution. In terms of adversary tactics, this exploit maps to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, particularly JavaScript sub-techniques used for client-side code injection. The failure stems from a logic error in the sanitization workflow rather than a simple omission of rules, highlighting the complexity involved in maintaining robust DOM security when dynamic modifications are permitted during the cleaning process.
To mitigate this vulnerability, organizations must immediately upgrade their dependencies to DOMPurify version 3.4.16 or later, where the developers have addressed the failure to sanitize detached subtrees within hooks. For environments unable to update instantly, a temporary mitigation involves avoiding the use of IN_PLACE mode if possible, opting instead for methods that return sanitized strings or new nodes which can be validated more thoroughly before insertion into the DOM. Additionally, implementing Content Security Policy headers with strict script-src directives can help mitigate the impact by restricting where scripts are allowed to execute, although this is a compensatory control and not a fix for the underlying code defect. Regular security audits of sanitization configurations and staying informed about library updates are essential practices for maintaining web application integrity against evolving XSS threats.