CVE-2026-109344 in DOMPurify
Riassunto
di MITRE • 12/10/2026
DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on* handlers inside a wrapper removed by such hooks, leaving handlers armed on the live DOM to execute script in the victim origin.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.