CVE-2026-75838 Overview
CVE-2026-75838 is a cross-site scripting (XSS) vulnerability in DOMPurify versions before 3.4.13. The flaw affects the IN_PLACE sanitization mode, where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML containing event handlers on descendant elements. These handlers execute after sanitization completes, even though the returned root element appears clean. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Attackers can execute arbitrary JavaScript in the victim's browser context by injecting crafted HTML that bypasses DOMPurify's IN_PLACE sanitization, leading to session theft, credential harvesting, or unauthorized actions in the application.
Affected Products
- DOMPurify versions prior to 3.4.13
- Web applications using DOMPurify with IN_PLACE sanitization mode
- Applications relying on element-removal hooks for custom sanitization logic
Discovery Timeline
- 2026-08-18 - CVE-2026-75838 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-75838
Vulnerability Analysis
DOMPurify is a widely used HTML sanitization library that removes potentially dangerous content from user-supplied markup. The library supports an IN_PLACE mode that sanitizes an existing DOM node rather than returning a new sanitized string. In vulnerable versions, when the sanitizer removes an element through a hook, it detaches the node from the returned root but does not fully neutralize its descendant subtree.
The result is that event handlers attached to descendant elements remain live in memory. When the browser later processes these detached nodes, the handlers can fire and execute attacker-controlled JavaScript. The returned root element passes inspection as clean, giving developers false confidence in the sanitization output.
This behavior undermines the core security guarantee of DOMPurify: that sanitized output is safe to render. Applications that trust IN_PLACE results and reuse detached nodes are directly exposed.
Root Cause
The root cause lies in the interaction between IN_PLACE mode and element-removal hooks. When a hook removes a parent element, DOMPurify does not recursively sanitize descendants before detachment. Event handlers and script-bearing attributes on those descendants remain intact.
Attack Vector
An attacker submits HTML input containing an element that triggers the removal hook, with malicious event handlers placed on child elements. Exploitation requires user interaction, such as viewing rendered content or triggering a specific event. Attack complexity is low and the vector is network-based. See the GitHub Security Advisory GHSA-55q2-fjhq-7xh7 for technical details.
The vulnerability manifests when developers pass untrusted HTML into DOMPurify with the IN_PLACE option set and rely on custom hooks to strip disallowed elements. No verified proof-of-concept code is publicly available at this time.
Detection Methods for CVE-2026-75838
Indicators of Compromise
- Client-side JavaScript errors or unexpected function calls originating from sanitized HTML regions of the page
- Outbound requests to attacker-controlled domains following user interaction with user-generated content
- Presence of DOM elements with inline event handlers such as onerror, onload, or onclick after DOMPurify processing
- Session cookies or authentication tokens appearing in referer headers or third-party logs
Detection Strategies
- Audit application dependencies for DOMPurify versions below 3.4.13 using package manifests such as package.json and lockfiles
- Review application code for uses of DOMPurify.sanitize() with the IN_PLACE: true option combined with custom uponSanitizeElement or uponSanitizeAttribute hooks
- Deploy content security policy (CSP) violation reporting to surface unexpected inline script execution
- Perform dynamic testing with payloads that place event handlers on descendants of removed parent elements
Monitoring Recommendations
- Monitor browser telemetry and CSP reports for script-src violations tied to user-generated content pages
- Track dependency updates in continuous integration pipelines to flag outdated DOMPurify versions
- Log server-side rejection of HTML payloads containing suspicious event handler attributes
How to Mitigate CVE-2026-75838
Immediate Actions Required
- Upgrade DOMPurify to version 3.4.13 or later across all application code and dependencies
- Inventory all uses of the IN_PLACE sanitization option and confirm the library version in each execution context
- Review custom hooks that remove elements and verify they do not rely on detached subtrees being safe
- Enforce a strict content security policy that disallows inline scripts and unsafe event handler execution
Patch Information
The fix is available in DOMPurify version 3.4.13. Application owners should update through their package manager, for example npm install dompurify@^3.4.13 or the equivalent for yarn and pnpm. Refer to the GitHub Security Advisory GHSA-55q2-fjhq-7xh7 and the VulnCheck advisory on DOMPurify for release notes and remediation guidance.
Workarounds
- Avoid the IN_PLACE sanitization mode until upgrading; use the default string-returning sanitize() call instead
- Discard detached nodes returned from removal hooks rather than reusing them elsewhere in the DOM
- Apply a strict CSP with script-src 'self' and no unsafe-inline to reduce the impact of successful injection
- Validate and reject HTML input containing event handler attributes at the server side before passing to the client sanitizer
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
