Description
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| cure53 | DOMPurify | < 3.4.13 | 3.4.13 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-dompurify | 3.4.13+dfsg-1 | — |
| Debian 13 | node-dompurify | No fix yet | — |
| Debian 12 | node-dompurify | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-dompurify | No fix yet | — |
| Ubuntu 26.04 LTS | node-dompurify | No fix yet | — |
| Ubuntu 24.04 LTS | node-dompurify | No fix yet | — |
| Ubuntu 22.04 LTS | node-dompurify | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.10-0.7.hum1 | RHSA-2026:70917 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.3-0.9.hum1 | RHSA-2026:67573 |
| Red Hat Hardened Images 1 | grafana13.2 | 13.2.1-0.6.hum1 | RHSA-2026:71906, RHSA-2026:70994 |
| Red Hat Ansible Automation Platform Inside 2 | receptor | 1.6.8-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform Developer 2 | automation-controller +1 | 4.7.17-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform Developer 2 | python-sqlparse +1 | 0.6.0-1.el10ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-sqlparse | 0.6.0-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform Developer 2 | receptor | 1.6.8-1.el9ap | RHSA-2026:71113 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform 2 | automation-controller +4 | 4.7.17-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-server | 2.6.17-3.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.14-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | python-sqlparse +1 | 0.6.0-1.el10ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | python3.12-gitpython | 3.1.60-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | python3.12-sqlparse | 0.6.0-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | receptor | 1.6.8-1.el9ap | RHSA-2026:71113 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | dompurify | < 3.4.13 | 3.4.13 | GHSA-55q2-fjhq-7xh7 |
Advisories 7
- WID-SEC-2026-3572 IBM i: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
- RHSA-2026:71906 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:71113 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:70917 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:70994 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:67573 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- NCSC-2026-0373 Kwetsbaarheden verholpen in Oracle Database Producten NCSC-NL (Netherlands) · Sep 16, 2026
References
- GitHub Security Advisory (GHSA-55q2-fjhq-7xh7) vendor-advisory
- VulnCheck Advisory: DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook third-party-advisory