npm/dompurify CVE-2026-75838: medium 5.1, EPSS 0.39%
DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS
Action: Upgrade dompurify to 3.4.13 or later.
npm i dompurify@3.4.13Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.4.13 | - |
Fixed versions
| 3.4.13 |
Sources
- osv: GHSA-55q2-fjhq-7xh7
- nvd: CVE-2026-75838
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7
- https://github.com/cure53/DOMPurify/pull/1557
- https://github.com/cure53/DOMPurify/commit/3067f7746769
- https://github.com/cure53/DOMPurify
- https://github.com/cure53/DOMPurify/releases/tag/3.4.13
CVE-2026-75838 · published · modified · JSON