CVE-2026-116803 in DOMPurify
Riassunto
di MITRE • 27/10/2026
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.
If you want to get best quality of vulnerability data, you may have to visit VulDB.