# CVE-2026-75838: DOMPurify IN_PLACE hook removal XSS via detached subtree

Source: https://junglewise.ai/threats/cve-2026-75838-dompurify-in-place-hook-removal-xss-via-detached-subtree  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75838 · Severity: medium · CVSS 4 · Published 2026-08-18

DOMPurify is a widely-used JavaScript library that sanitizes HTML to prevent XSS attacks on web pages. When configured for in-place sanitization with custom hooks that remove elements, the library may fail to disable event handlers on child elements that get detached. This allows malicious JavaScript to execute after the sanitization completes, bypassing the protection and compromising the application and its users' data.

Technologies: [dompurify (npm)](https://junglewise.ai/threats/technologies/dompurify). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-75838 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75838 being exploited in the wild.

**How severe is CVE-2026-75838?** Medium severity, with a CVSS score of 4, published 18 August 2026.

**Which products and versions are affected?** dompurify (npm) SEMVER:introduced=0,fixed=3.4.13.

**Is there a fix for CVE-2026-75838?** Yes. dompurify (npm): upgrade to 3.4.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75838 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-75838?** Check whether you run dompurify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- dompurify (npm): upgrade to 3.4.13 or later

  ```sh
  npm install dompurify@3.4.13
  ```


## Technical details

The vulnerability exists in DOMPurify 3.4.12's _sanitizeElements() function in src/purify.ts:1862-1904. When a beforeSanitizeElements or uponSanitizeElement hook detaches a DOM node, the code returns immediately without calling _neutralizeSubtree(currentNode) to disable event handlers. This leaves descendant resource elements (like img tags) with their attacker-supplied event handlers intact. If the browser has queued a resource event during construction, the handler fires asynchronously after sanitize() returns, even though the detached subtree is not connected to the document and the returned root is clean. The vulnerability requires two non-default conditions: IN_PLACE mode must be enabled and a hook must use the documented element-removal pattern. The issue was patched in version 3.4.13 by calling _neutralizeSubtree() before returning from hook-detachment branches.

## Affected products

- Cure53 DOMPurify 3.4.12 and earlier

## Identifiers

- CVE-2026-75838
- GHSA-55q2-fjhq-7xh7

## Timeline

- 2026-08-07: disclosed: GHSA-55q2-fjhq-7xh7 published
- 2026-08-03: patched: Version 3.4.13 released with fix

## References

- [https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7](https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7)
- [https://github.com/cure53/DOMPurify/pull/1557](https://github.com/cure53/DOMPurify/pull/1557)
- [https://github.com/cure53/DOMPurify/commit/3067f7746769](https://github.com/cure53/DOMPurify/commit/3067f7746769)
- [https://github.com/cure53/DOMPurify](https://github.com/cure53/DOMPurify)
- [https://github.com/cure53/DOMPurify/releases/tag/3.4.13](https://github.com/cure53/DOMPurify/releases/tag/3.4.13)

## Related threats

- [DOMPurify SAFE_FOR_TEMPLATES bypass in shadow root content](https://junglewise.ai/threats/dompurify-safe-for-templates-bypass-split-template-expressions-survive-c23665cf)
- [DOMPurify IN_PLACE event handler bypass when hook removes parent or sibling](https://junglewise.ai/threats/dompurify-in-place-hook-that-removes-a-parent-or-sibling-leaves-the-3ea5d18f)
- [DOMPurify SMIL attributeName=href guard bypass in XHTML mode](https://junglewise.ai/threats/dompurify-smil-attributename-href-guard-is-skipped-when-parser-media-15a5efd2)
- [DOMPurify IN_PLACE mode XSS via rawtext element text content](https://junglewise.ai/threats/dompurify-in-place-returns-a-force-removed-rawtext-root-whose-text-16d9ac9e)
- [DOMPurify DOM XSS in IN_PLACE mode with afterSanitize hooks](https://junglewise.ai/threats/dompurify-in-place-node-removing-aftersanitize-hook-leaves-detached-3087e7fd)