CVE-2026-109345: DOMPurify XSS Sanitization Bypass Vulnerability

CVE-2026-109345 Overview

CVE-2026-109345 is a cross-site scripting (XSS) vulnerability in DOMPurify versions prior to 3.4.16. The flaw resides in the library's IN_PLACE sanitization mode, which returns a force-removed style element whose text content still carries attacker-controlled markup. When the calling application serializes and re-parses the returned node, the embedded payload executes in the browser context. The issue is tracked under [CWE-79] and documented in the GitHub Security Advisory GHSA-6688.

Critical Impact
Attackers can bypass DOMPurify sanitization and execute arbitrary JavaScript in the context of applications that rely on IN_PLACE mode and later serialize the sanitized output.

Affected Products

DOMPurify versions prior to 3.4.16
Web applications invoking DOMPurify with the IN_PLACE return mode
Downstream libraries and frameworks bundling vulnerable DOMPurify releases

Discovery Timeline

2026-10-12 - CVE-2026-109345 published to the National Vulnerability Database
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-109345

Vulnerability Analysis

DOMPurify sanitizes HTML by walking the DOM and removing disallowed elements, including style tags when configured to strip them. In IN_PLACE mode, the library returns the node that was passed in rather than producing a fresh serialized string. The sanitizer force-removes the style element but still returns a root node whose text content retains the original markup verbatim. Because style is a rawtext element, its contents are not parsed as HTML during the initial pass and are therefore not sanitized.

When the application later serializes this returned root to a string and re-inserts it into the DOM, the browser re-parses the rawtext content as HTML. Any closing </style> sequence breaks out of the rawtext context, and subsequent tags such as <img src=x onerror=...> are interpreted and executed. This defeats the trust boundary that applications expect from DOMPurify.

Root Cause

The root cause is unsafe handling of rawtext element contents during IN_PLACE returns. The sanitizer treats removal of the element itself as sufficient but preserves its unescaped text payload on the returned root. The security contract between sanitize-then-serialize steps is violated.

Attack Vector

Exploitation requires an attacker to supply HTML containing a style element with a nested closing </style> tag followed by an injected payload such as <img src=x onerror=alert(1)>. The attack succeeds only when the host application uses IN_PLACE mode and subsequently serializes and re-parses the returned node. User interaction, such as rendering attacker-controlled content, is required. See the VulnCheck Advisory: DOMPurify XSS for additional technical context.

Detection Methods for CVE-2026-109345

Indicators of Compromise

Inbound HTML payloads containing style elements with embedded </style> sequences followed by executable tags such as img onerror=
Client-side errors or unexpected script execution originating from DOM nodes previously sanitized by DOMPurify
Dependency manifests (package.json, package-lock.json, yarn.lock) referencing DOMPurify versions below 3.4.16

Detection Strategies

Perform software composition analysis (SCA) across front-end builds and bundled artifacts to flag DOMPurify versions earlier than 3.4.16
Audit application source for calls to DOMPurify that pass the IN_PLACE option and subsequently serialize the returned node via innerHTML, outerHTML, or XMLSerializer
Deploy Content Security Policy (CSP) violation reporting to surface inline script execution attempts that bypass sanitization

Monitoring Recommendations

Instrument web application firewalls (WAF) to log requests containing <style> tags with nested closing tags and onerror attributes
Monitor browser error telemetry and CSP reports for anomalous script-source violations tied to user-generated content surfaces
Track dependency drift in CI/CD pipelines to detect downgrades or transitive pulls of pre-3.4.16 DOMPurify releases

How to Mitigate CVE-2026-109345

Immediate Actions Required

Upgrade DOMPurify to version 3.4.16 or later across all applications and bundled dependencies
Audit any code paths using the IN_PLACE mode and validate how the returned root is serialized downstream
Rebuild and redeploy front-end artifacts to ensure the patched library is shipped to production clients

Patch Information

The maintainers resolved the issue in DOMPurify 3.4.16. Full patch details, affected code paths, and remediation guidance are available in the GitHub Security Advisory GHSA-6688.

Workarounds

Avoid the IN_PLACE return mode and use DOMPurify's default string-return API, which produces already-serialized, safe output
Add style to the FORBID_TAGS configuration and strip rawtext elements before passing input to DOMPurify
Enforce a strict Content Security Policy that disallows inline event handlers to reduce impact of residual XSS vectors

bash

# Configuration example: upgrade DOMPurify to the patched release
npm install dompurify@^3.4.16
# or
yarn upgrade dompurify@^3.4.16