Is CVE-2026-75838 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75838 being exploited in the wild.

How severe is CVE-2026-75838?

Medium severity, with a CVSS score of 4, published 18 August 2026.

Which products and versions are affected?

dompurify (npm) SEMVER:introduced=0,fixed=3.4.13.

Is there a fix for CVE-2026-75838?

Yes. dompurify (npm): upgrade to 3.4.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-75838 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-75838?

Check whether you run dompurify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75838: DOMPurify IN_PLACE hook removal XSS via detached subtree

CVE-2026-75838 · Severity: medium · CVSS 4 · Published 2026-08-18

DOMPurify is a widely-used JavaScript library that sanitizes HTML to prevent XSS attacks on web pages. When configured for in-place sanitization with custom hooks that remove elements, the library may fail to disable event handlers on child elements that get detached. This allows malicious JavaScript to execute after the sanitization completes, bypassing the protection and compromising the application and its users' data.

Technologies: dompurify (npm). Vendors: npm.

Quick answers

Is CVE-2026-75838 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75838 being exploited in the wild.
How severe is CVE-2026-75838?: Medium severity, with a CVSS score of 4, published 18 August 2026.
Which products and versions are affected?: dompurify (npm) SEMVER:introduced=0,fixed=3.4.13.
Is there a fix for CVE-2026-75838?: Yes. dompurify (npm): upgrade to 3.4.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75838 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-75838?: Check whether you run dompurify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

dompurify (npm): upgrade to 3.4.13 or later
```
npm install dompurify@3.4.13
```

Technical details

The vulnerability exists in DOMPurify 3.4.12's _sanitizeElements() function in src/purify.ts:1862-1904. When a beforeSanitizeElements or uponSanitizeElement hook detaches a DOM node, the code returns immediately without calling _neutralizeSubtree(currentNode) to disable event handlers. This leaves descendant resource elements (like img tags) with their attacker-supplied event handlers intact. If the browser has queued a resource event during construction, the handler fires asynchronously after sanitize() returns, even though the detached subtree is not connected to the document and the returned root is clean. The vulnerability requires two non-default conditions: IN_PLACE mode must be enabled and a hook must use the documented element-removal pattern. The issue was patched in version 3.4.13 by calling _neutralizeSubtree() before returning from hook-detachment branches.

Affected products

Cure53 DOMPurify 3.4.12 and earlier

Identifiers

CVE-2026-75838
GHSA-55q2-fjhq-7xh7

Timeline

2026-08-07: disclosed: GHSA-55q2-fjhq-7xh7 published
2026-08-03: patched: Version 3.4.13 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.