Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 4, published 22 October 2026.

Which products and versions are affected?

Cure53 DOMPurify <= 3.4.16; DOMPurify 3.4.16 and earlier including 3.4.15, 3.4.12, 2.5.8; dompurify (npm) <= 3.4.16, SEMVER:introduced=0,fixed=3.4.17.

Is there a fix for This vulnerability?

Yes. dompurify (npm): upgrade to 3.4.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Cure53 DOMPurify, DOMPurify or dompurify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

DOMPurify IN_PLACE event handler bypass when hook removes parent or sibling

Q: Which products and versions are affected?

Cure53 DOMPurify <= 3.4.16; DOMPurify 3.4.16 and earlier including 3.4.15, 3.4.12, 2.5.8; dompurify (npm) <= 3.4.16, SEMVER:introduced=0,fixed=3.4.17.

Q: Is there a fix for This vulnerability?

Yes. dompurify (npm): upgrade to 3.4.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run Cure53 DOMPurify, DOMPurify or dompurify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: high · CVSS 4 · Published 2026-10-22

DOMPurify is a library used by web applications to sanitize HTML and remove malicious content like event handlers. When using the IN_PLACE sanitization mode with custom hooks that remove a parent element or sibling, event handlers on detached elements remain active and can execute after sanitization completes. An attacker can craft HTML with malicious event handlers that fire after the application believes the content is safe, leading to DOM-based cross-site scripting (XSS).

Technologies: Cure53 DOMPurify, dompurify (npm). Vendors: Cure53, npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 4, published 22 October 2026.
Which products and versions are affected?: Cure53 DOMPurify <= 3.4.16; DOMPurify 3.4.16 and earlier including 3.4.15, 3.4.12, 2.5.8; dompurify (npm) <= 3.4.16, SEMVER:introduced=0,fixed=3.4.17.
Is there a fix for This vulnerability?: Yes. dompurify (npm): upgrade to 3.4.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Cure53 DOMPurify, DOMPurify or dompurify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

dompurify (npm): upgrade to 3.4.17 or later
```
npm install dompurify@3.4.17
```

Technical details

The vulnerability is an incomplete fix for GHSA-p98j-92pf-mc4p in the _handleHookDetachedNode() function. The code only checks if the current node lost its parent, but when a hook removes an ancestor or sibling node instead, the subtree becomes unreachable to the tree walker and is not added to DOMPurify.removed. This causes the subtree's event handlers (like img onerror) to remain armed. The issue affects all five element and attribute hooks (beforeSanitizeElements, uponSanitizeElement, afterSanitizeElements, beforeSanitizeAttributes, afterSanitizeAttributes) in IN_PLACE mode.

Affected products

cure53 DOMPurify <= 3.4.16

Timeline

2026-10-22: disclosed
2026-10-22: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.