CVE-2026-109345— DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root
Quick assessment
Affected
cure53 DOMPurify
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
DOMPurify 3.4.16 版本之前的版本存在跨站脚本（XSS）漏洞，攻击者可利用该漏洞绕过 sanitization（内容清洗/过滤）机制。该漏洞源于 IN_PLACE 模式返回一个被强制移除的 元素，而其文本内容仍携带标记（markup）。攻击者可以提供包含闭合 标签以及带有 属性的 标签的 元素，当应用程序序列化并重新解析返回的节点时，将触发脚本执行。
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109345
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root
Source: CVE Program / CVE List V5
Vulnerability Description
DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the returned node.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-109345
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109345
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-109345 (2)
IV. Related Vulnerabilities
Same product: DOMPurify
-
CVE-2026-109344
DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE aft -
CVE-2026-75838
DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE ho -
CVE-2026-66010
DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDL -
CVE-2026-65914
DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization -
CVE-2026-65913
DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES
Same vendor: cure53
-
CVE-2026-109344
DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE aft -
CVE-2026-75838
DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE ho -
CVE-2026-66010
DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDL -
CVE-2026-65914
DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization -
CVE-2026-65913
DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES
Same weakness: CWE-79
-
CVE-2026-110103
bbs-go through 4.4.6 Stored XSS via Image Upload Content-Typ -
CVE-2026-110101
Koillection through 1.8.4 Stored XSS via Datum File Attachme -
CVE-2026-104250
unstructured: Stored XSS via unescaped HTML generation -
CVE-2026-55562
Cronicle: Stored XSS in admin Activity Log via account full_ -
CVE-2026-102989
TanStack Router: Unauthenticated reflected XSS in TanStack S
V. Comments for CVE-2026-109345
No comments yet