CVE-2026-75838 in DOMPurify
Riassunto
di MITRE • 18/08/2026
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.