Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 4, published 30 September 2026.

Which products and versions are affected?

Cure53 DOMPurify 3.4.13 to 3.4.15; dompurify (npm) SEMVER:introduced=3.4.13,fixed=3.4.16.

Is there a fix for This vulnerability?

Yes. dompurify (npm): upgrade to 3.4.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run Cure53 DOMPurify or dompurify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

DOMPurify DOM XSS in IN_PLACE mode with afterSanitize hooks

Severity: medium · CVSS 4 · Published 2026-09-30

DOMPurify is a JavaScript library that sanitizes HTML to prevent cross-site scripting (XSS) attacks. When used in IN_PLACE mode with afterSanitize hooks, a flaw allows event handlers to persist on detached DOM nodes even after sanitization. An attacker who supplies malicious markup can execute arbitrary JavaScript in the victim's browser session.

Technologies: Cure53 DOMPurify, dompurify (npm). Vendors: Cure53, npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 4, published 30 September 2026.
Which products and versions are affected?: Cure53 DOMPurify 3.4.13 to 3.4.15; dompurify (npm) SEMVER:introduced=3.4.13,fixed=3.4.16.
Is there a fix for This vulnerability?: Yes. dompurify (npm): upgrade to 3.4.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run Cure53 DOMPurify or dompurify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

dompurify (npm): upgrade to 3.4.16 or later
```
npm install dompurify@3.4.16
```

Technical details

The vulnerability occurs in DOMPurify's IN_PLACE sanitization mode when a node-removing afterSanitizeElements or afterSanitizeAttributes hook detaches non-root elements. The _handleHookDetachedNode neutralization helper is missing from the afterSanitize return paths and _sanitizeAttributes, leaving event handler attributes (on*) intact on detached subtrees. Because IN_PLACE mutates the caller's live DOM, queued event handlers on detached descendants fire in page scope after sanitize() returns, achieving DOM XSS without special privileges.

Affected products

Cure53 DOMPurify 3.4.13 to 3.4.15

Timeline

2026-09-30: disclosed
2026-09-30: patched: Patched in version 3.4.16

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.