CVE-2026-109344 DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks
Attackers can execute arbitrary JavaScript in the victim's origin by exploiting DOMPurify's IN_PLACE mode when custom sanitization hooks are used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-109344?
CVE-2026-109344 is a medium-severity cross-site scripting vulnerability in cure53 DOMPurify, published on 12 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on* handlers inside a wrapper removed by such hooks, leaving handlers armed on the live DOM to execute script in the victim origin.
Weakness: CWE-79
Which versions are affected by CVE-2026-109344?
2 open source packages ship an affected version, including dompurify.
| Package | Affected | Fixed in |
|---|---|---|
dompurify npm | From 3.4.13 | 3.4.16 |
dompurify npm | From 3.4.13 | 3.4.16 |
How do I fix CVE-2026-109344?
Upgrade dompurify to 3.4.16 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-109344 being exploited?
There is no known exploitation of CVE-2026-109344 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1790884902, DEBIAN-CVE-2026-109344, ECHO-e468-7586-9019, GHSA-59fh-8xxf-p69h, GHSA-p98j-92pf-mc4p, MINI-f2qg-xq49-77f8 and 4 more.