CVE-2026-75838 in DOMPurify
Summary
by MITRE • 08/18/2026
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The security flaw identified in DOMPurify versions prior to 3.4.13 represents a critical bypass of cross-site scripting protections within its IN_PLACE sanitization mode. This vulnerability stems from an incomplete implementation of element-removal hooks, which are designed to sanitize HTML content by removing dangerous nodes and attributes before they can be executed by the browser's rendering engine. In standard operation, DOMPurify parses the input HTML into a Document Object Model tree, iterates through it to strip out malicious elements such as script tags or event handlers like onerror or onclick, and then either returns a cleaned string or updates the existing DOM node in place. The defect occurs specifically during this iterative cleanup process when certain nodes are detached from their parent containers but not fully neutralized before being reattached or processed further.
The technical root cause lies in how the library handles detached subtrees during traversal. When an element is removed from its original position, it may still retain event listeners or inline handlers attached to descendant elements that were not explicitly targeted for removal by the primary sanitization rules. Because these descendants remain part of a valid DOM structure even after their parent has been logically isolated, they can be inadvertently reintroduced into the active document tree if the application logic relies on specific reattachment patterns common in IN_PLACE mode. Consequently, an attacker who supplies HTML containing nested elements with event handlers can cause those handlers to persist and execute upon subsequent interactions or rendering cycles, effectively bypassing the intended security boundaries of the sanitizer.
From a threat modeling perspective, this vulnerability aligns closely with CWE-79, which classifies improper neutralization of input during web page generation as Cross-site Scripting (XSS). Furthermore, it maps to MITRE ATT&CK technique T1059.007, specifically JavaScript execution within the browser environment. The operational impact is severe because IN_PLACE sanitization is often used in dynamic single-page applications where content is frequently updated without full page reloads. If an attacker can inject malicious payloads that survive this process, they gain the ability to execute arbitrary JavaScript code in the context of the victim's session. This can lead to account takeover through cookie theft, redirection to phishing sites, defacement of the user interface, or further propagation of malware within the application ecosystem.
The severity is compounded by the fact that many developers rely on DOMPurify as a primary defense mechanism against XSS attacks. The assumption that IN_PLACE mode provides equivalent security guarantees to full string sanitization proves false in this scenario due to the stateful nature of detached nodes and their associated event bindings. Attackers do not need complex multi-stage exploits; they simply need to craft HTML payloads where dangerous attributes are nested within elements that might be temporarily detached during the sanitization loop but remain structurally valid enough to trigger execution later. This makes detection difficult for automated scanners that only check if the final output string contains obvious script tags, as the payload may appear clean in static analysis while remaining executable at runtime.
To mitigate this vulnerability, organizations must immediately upgrade DOMPurify to version 3.4.13 or later, where the element-removal hooks have been patched to ensure that all detached subtrees are thoroughly neutralized before any reattachment occurs. This patch ensures that event listeners and inline handlers on descendants of removed nodes are properly stripped or disconnected from the active DOM tree. In addition to upgrading dependencies, developers should review applications using IN_PLACE sanitization for potential side effects related to dynamic content updates. Implementing Content Security Policy headers with strict script-src directives can provide a secondary layer of defense by restricting the sources from which scripts can be loaded and executed, thereby limiting the impact even if an XSS vector is successfully exploited. Regular security audits focusing on DOM-based vulnerabilities are also recommended to identify similar patterns in custom sanitization logic or third-party libraries that may suffer from analogous implementation flaws.