CVE-2026-109345
6.1MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Attackers can execute arbitrary JavaScript in a victim's browser if the victim views specially crafted markup. The attacker needs the application to sanitize input with IN_PLACE mode and re-parse or serialize the returned node.
Root cause
When IN_PLACE mode is used, DOMPurify returns a force-removed style element that still retains malicious text content.
Affected systems
DOMPurify versions before 3.4.16
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Fix & remediation
Upgrade to DOMPurify 3.4.16 or later. If patching immediately is not possible, disable the IN_PLACE configuration option in your sanitization calls.
$ npm install dompurify@latestAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the returned node.