DOMPurify CVE-2026-109345

Exploitation requires the target application to call DOMPurify.sanitize(node, { IN_PLACE: true }) on a Node input (not a string) using a vulnerable version <=3.4.15, and to subsequently serialize the returned node and re-parse that serialized HTML in a plain HTML context - the published PoC runs with SAFE_FOR_XML at its default (true). The specific trigger is a rawtext element (e.g. <style>) whose text content carries markup (a closing </style> tag plus an img onerror payload); the 3.4.9 _forceRemove TypeError guard and _neutralizeSubtree attribute-stripping do not touch text content, so the killed node is returned with live markup. LIMITING FACTORS: this is not a default DOMPurify usage pattern - string inputs and non-IN_PLACE sanitization return an empty/safe result, so applications not using IN_PLACE mode with node inputs and a serialize-then-reparse round-trip are not affected. CVSS UI:A also indicates active victim interaction is part of the attack path.

CVSS 4.0 base score is 5.1 (medium): AV:N/AC:L/AT:N/PR:N/UI:A with no impact on the vulnerable system (VC:N/VI:N/VA:N) and low confidentiality/integrity impact on a subsequent system (SC:L/SI:L) - i.e. a classic client-side XSS whose damage lands in the victim's browser session rather than on the DOMPurify host. No EPSS score, SSVC decision, or CISA KEV status was provided in the input, so there is no quantitative exploitation-probability or automatability signal to weigh; absence of KEV means there is no evidence of active exploitation. However, the GHSA advisory ships a complete, independently-reproduced proof-of-concept (jsdom 30.0.1/29.1.1, Node 20.x/26.x), so working exploit code is effectively public. The signals are internally consistent - network vector with required user interaction matches a reflected/stored XSS - but exploitability is heavily gated by a non-default integration pattern (the target application must call DOMPurify.sanitize with IN_PLACE:true on a Node input and then serialize and re-parse the returned node), which is not captured by the CVSS metrics and materially lowers real-world reach. Net: a real but conditional XSS bug in a very widely used library; prioritize for applications known to use IN_PLACE mode, treat as lower urgency elsewhere. No EPSS/KEV data available - risk ranking relies on CVSS and confirmed PoC only.

An attacker submits user-controlled content containing a <style> element whose text is '</style><img src=x onerror=...>' to a web application that sanitizes nodes with DOMPurify.sanitize(node, { IN_PLACE: true }). DOMPurify force-removes the rawtext root but returns it with its text payload intact; when the application serializes the returned node and re-parses the HTML, the img onerror handler executes script in the victim's browser. A working proof-of-concept is published in the GHSA advisory.