Security Advisory

CVE-2026-75838

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-18 11:19:47

Last updated 2026-08-18 13:38:34

Assigner VulnCheck

CVSS score not scored

State PUBLISHED

Description

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

← Browse all CVEs View on cve.org ↗