CVE-2026-109344
MEDIUM
NVD
CVSS Score
6.1
Severity
MEDIUM
Published
Oct 12, 2026
Vendor
unknown
Description
DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on* handlers inside a wrapper removed by such hooks, leaving handlers armed on the live DOM to execute script in the victim origin.