SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-75838

MEDIUM · CVSS 5.1 EPSS 0.30% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-18 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

DOMPurify versions prior to 3.4.13 are vulnerable to a cross-site scripting (XSS) flaw in their IN_PLACE sanitization process, allowing attackers to inject malicious HTML with event handlers that can execute post-sanitization. This vulnerability can lead to unauthorized script execution in web applications, potentially compromising user data and session integrity. Developers and security teams utilizing affected versions should prioritize updates to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-75838
Severity
MEDIUM
CVSS
5.1
EPSS
0.30%

Original NVD Description

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.