CVE-2026-109344 Overview
CVE-2026-109344 is a cross-site scripting [CWE-79] vulnerability in DOMPurify versions 3.4.13 through 3.4.15. The flaw affects IN_PLACE sanitization mode when applications use afterSanitizeElements or afterSanitizeAttributes hooks to detach subtrees. DOMPurify fails to neutralize these detached subtrees, leaving on* event handlers armed on the live DOM. Attackers craft markup containing event handlers inside a wrapper element that a hook removes. The handlers then execute script in the victim origin when the DOM processes them.
Critical Impact
Attackers can achieve DOM-based XSS execution in the victim origin by supplying crafted HTML to applications using DOMPurify with IN_PLACE mode and afterSanitize hooks.
Affected Products
- DOMPurify 3.4.13
- DOMPurify 3.4.14
- DOMPurify 3.4.15
Discovery Timeline
- 2026-10-12 - CVE-2026-109344 published to the National Vulnerability Database (NVD)
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-109344
Vulnerability Analysis
DOMPurify sanitizes HTML to prevent XSS by stripping dangerous elements and attributes before content reaches the DOM. The library supports an IN_PLACE mode that mutates an existing DOM subtree rather than returning a sanitized string. Applications frequently extend sanitization with afterSanitizeElements and afterSanitizeAttributes hooks to enforce custom policies.
The vulnerability stems from DOMPurify not re-sanitizing nodes that these hooks detach from the processed tree. When a hook removes a wrapper element, any inline event handlers nested within that wrapper remain attached to live DOM nodes. The sanitizer treats the wrapper's removal as sufficient, but the child handlers survive on nodes still present elsewhere in the document.
Root Cause
The root cause is an incomplete sanitization pass in IN_PLACE mode. DOMPurify assumes that removing a parent node eliminates its subtree from consideration. Hooks that reparent or detach subtrees break this assumption. The library does not re-walk affected subtrees after hook execution to strip on* attributes, allowing event handlers to persist on the live DOM.
Attack Vector
Exploitation requires an application that uses DOMPurify versions 3.4.13 through 3.4.15 with IN_PLACE mode and an afterSanitizeElements or afterSanitizeAttributes hook that detaches subtrees. An attacker submits HTML containing a wrapper element the hook will remove, with child elements carrying event handler attributes such as onclick, onerror, or onmouseover. User interaction triggers the retained handlers, executing attacker-controlled JavaScript in the victim's origin. See the GitHub Security Advisory GHSA-p98j-92pf-mc4p for technical details.
Detection Methods for CVE-2026-109344
Indicators of Compromise
- Unexpected script execution originating from user-generated content fields rendered through DOMPurify.
- Browser console errors referencing inline event handlers on sanitized DOM nodes.
- Outbound requests to attacker-controlled domains from pages that render sanitized HTML.
Detection Strategies
- Inventory application dependencies to identify DOMPurify versions between 3.4.13 and 3.4.15 using software composition analysis tools.
- Review application source for DOMPurify.sanitize calls that pass IN_PLACE: true alongside addHook('afterSanitizeElements', ...) or addHook('afterSanitizeAttributes', ...).
- Instrument Content Security Policy (CSP) reporting to capture inline script execution violations that may indicate exploitation attempts.
Monitoring Recommendations
- Monitor CSP violation reports for script-src and inline-event violations on pages that render user-supplied HTML.
- Log and alert on anomalous JavaScript execution patterns in client-side telemetry or Real User Monitoring (RUM) tools.
- Correlate web application firewall (WAF) logs for HTML payloads containing on* handler attributes submitted to sanitization endpoints.
How to Mitigate CVE-2026-109344
Immediate Actions Required
- Upgrade DOMPurify to version 3.4.16 or later across all affected applications and build pipelines.
- Audit custom hooks registered with addHook to identify any that detach or reparent DOM subtrees during sanitization.
- Enforce a strict Content Security Policy that blocks inline event handlers as a defense-in-depth measure.
Patch Information
DOMPurify 3.4.16 remediates the vulnerability by ensuring that subtrees affected by afterSanitizeElements and afterSanitizeAttributes hooks are fully re-sanitized. Review the GitHub Security Advisory GHSA-p98j-92pf-mc4p and the VulnCheck Advisory for DOMPurify for complete patch guidance.
Workarounds
- Disable IN_PLACE mode until the DOMPurify upgrade is deployed, and use the default string-returning sanitization path.
- Remove or refactor afterSanitizeElements and afterSanitizeAttributes hooks that detach subtrees; perform detachment outside the sanitization pipeline.
- Apply a secondary attribute-stripping pass after hook execution to remove any residual on* handlers from live DOM nodes.
# Upgrade DOMPurify using npm
npm install dompurify@^3.4.16
# Verify the installed version
npm list dompurify
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
