XSS in Cure53 Dompurify

CVE-2026-75838

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

Vulnerability class: XSS (Cross-Site Scripting)

Published · last modified .

EPSS exploit prediction

EPSS: 0.003 (20.6th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 21st percentile — 20.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-75838: held from 0.003 to 0.003.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000

Affected products

Weakness classification (CWE)

References