CVE-2026-75838
Fixed in a distro release EPSS <1%CVSS 5.1
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Products: cure53 dompurify
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | dompurify | 3.4.13 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | node-dompurify | no fix |
| Debian 13 | node-dompurify | no fix |
| Debian 14 | node-dompurify | 3.4.13+dfsg-1 |
| Red Hat ansible automation platform 2.6 | automation-controller | 0:4.7.17-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-cli | 0:4.7.17-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-server | 0:4.7.17-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-ui | 0:4.7.17-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-venv-tower | 0:4.7.17-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-gateway-proxy-server | 0:2.6.17-3.el9ap |
| Red Hat ansible automation platform 2.6 | automation-platform-ui | 0:2.6.14-1.el9ap |
| Red Hat ansible automation platform 2.6 | python-sqlparse | 0:0.6.0-1.el10ap |
| Red Hat ansible automation platform 2.6 | python3-sqlparse | 0:0.6.0-1.el10ap |
| Red Hat ansible automation platform 2.6 | python3.12-gitpython | 0:3.1.60-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-sqlparse | 0:0.6.0-1.el9ap |
| Red Hat ansible automation platform 2.6 | receptor | 0:1.6.8-1.el9ap |
| Red Hat ansible automation platform 2.6 | receptor | 0:1.6.8-1.el10ap |
| Red Hat ansible automation platform developer 2.6 | automation-controller | 0:4.7.17-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | automation-controller-cli | 0:4.7.17-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | python-sqlparse | 0:0.6.0-1.el10ap |
| Red Hat ansible automation platform developer 2.6 | python3-sqlparse | 0:0.6.0-1.el10ap |
| Red Hat ansible automation platform developer 2.6 | python3.12-sqlparse | 0:0.6.0-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | receptor | 0:1.6.8-1.el9ap |
| Red Hat ansible automation platform inside 2.6 | receptor | 0:1.6.8-1.el9ap |
| Red Hat hummingbird 1 | grafana12.4 | 0:12.4.10-0.7.hum1 |
| Red Hat hummingbird 1 | grafana13.1 | 0:13.1.3-0.9.hum1 |
| Red Hat hummingbird 1 | grafana13.2 | 0:13.2.1-0.6.hum1 |
| Red Hat hummingbird 1 | grafana13.2 | 0:13.2.1-0.7.hum1 |
| Ubuntu 22.04 LTS | node-dompurify | no fix |
| Ubuntu 24.04 LTS | node-dompurify | no fix |
| Ubuntu 26.04 LTS | node-dompurify | no fix |
| Ubuntu 26.10 | node-dompurify | no fix |