{"action":"Upgrade dompurify to 3.4.16 or later.","affected":[{"fixed":"3.4.16","introduced":"0"}],"component":"dompurify","cve_ids":["CVE-2026-109345"],"ecosystem":"npm","epss":0.0025,"exploited":false,"fixed_versions":["3.4.16"],"ghsa_id":"GHSA-6688-9rhm-gjv2","id":"tcs_01M5KF5YRZBM1ZNSKJZTF210XT","modified_at":"2026-10-13T02:56:32.032824370Z","published_at":"2026-10-05T23:43:53Z","references":["https://osv.dev/vulnerability/GHSA-6688-9rhm-gjv2","https://github.com/cure53/DOMPurify/security/advisories/GHSA-6688-9rhm-gjv2","https://github.com/cure53/DOMPurify/pull/1636","https://github.com/cure53/DOMPurify/commit/b9b9d80f7e401771c2ccaef5f45def7eec8f27d7","https://github.com/cure53/DOMPurify","https://github.com/cure53/DOMPurify/releases/tag/3.4.16"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-6688-9rhm-gjv2","url":"https://osv.dev/vulnerability/GHSA-6688-9rhm-gjv2"},{"source":"nvd","source_id":"CVE-2026-109345","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109345"}],"summary":"DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes"}