CVE-2026-75838

5.1 Moyenne

Publiée le 18/08/2026 à 14:19 · Modifiée le 23/10/2026 à 00:10 · En attente d'analyse NVD · Source : disclosure@vulncheck.com

Description

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

Traduire en français

Produits concernés

cure53 DOMPurify

Scores CVSS

Version	Score	Source	Vecteur
4.0	5.1 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-79

Références

https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7
https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook
https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories