EUVD-2026-60602
GHSA-748c-f84h-hp2v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the double precondition of IN_PLACE mode plus an element-removal hook; PR:N since the attacker only supplies HTML; S:C for script execution in the victim's browser origin.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4Blast Radius
ecosystem impact- 127 npm packages depend on dompurify (65 direct, 62 indirect)
Ecosystem-wide dependent count for version 3.4.13.
DescriptionCVE.org
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
AnalysisAI
IN_PLACE sanitization bypass in DOMPurify before 3.4.13 enables persistent cross-site scripting after sanitize() returns, affecting any application that uses DOMPurify's documented element-removal hook pattern with IN_PLACE mode enabled. When a uponSanitizeElement or beforeSanitizeElements hook removes a node via node.remove(), DOMPurify's _sanitizeElements() exits that node's processing branch without invoking _neutralizeSubtree(), leaving descendant elements - including those carrying browser-queued event handlers such as img onload - outside both the returned DOM and the DOMPurify.removed list. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concurrent conditions must be met: (1) the application must explicitly pass IN_PLACE: true in the DOMPurify configuration - this is a non-default mode that must be deliberately opted into by the developer; (2) the application must register a hook via DOMPurify.addHook() on 'uponSanitizeElement' or 'beforeSanitizeElements' that calls node.remove() on a matched element during sanitization; and (3) the attacker must be able to supply HTML content that the application passes to DOMPurify.sanitize(). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) accurately reflects moderate real-world severity; the subsequent-system impact metrics SC:L and SI:L capture the typical XSS consequence of arbitrary JavaScript execution in the victim's browser session. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting a web application that accepts user-supplied HTML - such as a rich-text comment field or content import feature - crafts a payload containing an img element with a data-URI src and an onload event handler, nested inside a footer element that a registered uponSanitizeElement hook removes via node.remove(). The application calls DOMPurify.sanitize(root) with IN_PLACE: true; the hook fires for the footer element, detaches it (and the img descendant), and the function returns early - bypassing _neutralizeSubtree(). … |
| Remediation | Upgrade DOMPurify to version 3.4.13 or later (npm install dompurify@3.4.13), which contains the fix confirmed in upstream commit https://github.com/cure53/DOMPurify/commit/3067f7746769 and pull request https://github.com/cure53/DOMPurify/pull/1557, as documented in the vendor advisory at https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated medium severity (CVSS 6
Cure53 DOMPurify before 2.0.17 allows mutation XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp
DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demo
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated critical severity (CVSS
Mutation-XSS in DOMPurify before 3.3.2 enables JavaScript execution in victim browsers when sanitized output is re-inser
Hook mutation pollution in DOMPurify <= 3.4.5 allows persistent bypass of HTML sanitization defaults when application-in
Trusted Types policy state contamination in DOMPurify 3.0.0-3.4.8 allows a previously supplied TRUSTED_TYPES_POLICY to s
Prototype pollution in DOMPurify's USE_PROFILES mode enables DOM-based XSS by causing the sanitizer to accept event hand
URI validation bypass in DOMPurify 3.3.1 and earlier allows `javascript:` protocol payloads to survive HTML sanitization
SAFE_FOR_TEMPLATES bypass in DOMPurify 3.0.0-3.4.7 allows template expressions such as ${evil}, {{evil}}, and <%evil%> t
Cross-site scripting in DOMPurify 3.4.6 and earlier enables script execution when the library's IN_PLACE sanitization mo
Stored XSS is achievable in applications using DOMPurify's setConfig() API combined with an uponSanitizeAttribute hook t
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today