Skip to content
Fencer Intel
medium 5.1

CVE-2026-75838 json

DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

published 3mo ago modified 20d ago also EUVD-2026-60602 , GHSA-55q2-fjhq-7xh7

cvss
5.1
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits
0
none known

Summary

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

Patch / fix

  • npm dompurify 3.4.13
  • cure53 DOMPurify 3.4.13
  • node-dompurify Debian 14 3.4.13+dfsg-1

debian advisories DEBIAN-CVE-2026-75838

  • grafana13.2 hummingbird 1 13.2.1-0.7.hum1
  • receptor ansible automation platform 2.6 1.6.8-1.el10ap
  • receptor ansible automation platform inside 2.6, ansible automation platform developer 2.6, ansible automation platform 2.6 1.6.8-1.el9ap
  • python-sqlparse ansible automation platform developer 2.6, ansible automation platform 2.6 0.6.0-1.el10ap
  • python3-sqlparse ansible automation platform developer 2.6, ansible automation platform 2.6 0.6.0-1.el10ap
  • python3.12-sqlparse ansible automation platform developer 2.6, ansible automation platform 2.6 0.6.0-1.el9ap
  • python3.12-gitpython ansible automation platform 2.6 3.1.60-1.el9ap
  • automation-controller ansible automation platform developer 2.6, ansible automation platform 2.6 4.7.17-1.el9ap

red hat advisories RHSA-2026:71906RHSA-2026:71113RHSA-2026:70994RHSA-2026:70917RHSA-2026:67573

Is CVE-2026-75838 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-75838 updated cvss 6.1

dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization

  • Red Hat Ansible Automation Orchestrator 2026 ansible-automation-platform/automation-orchestrator-ui-rhel9 Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-console-plugin-rhel9
    affected: workaround, no fix available
  • Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8, workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9, redhat-user-workloads/rhwa-tenant/node-healthcheck-operator/nhc-bundle-0-9, redhat-user-workloads/rhwa-tenant/node-healthcheck-operator/nhc-operator-0-9, +1 more
    affected: workaround, no fix available, no fix planned “Out of support scope”
  • Red Hat Advanced Cluster Management for Kubernetes 2 redhat-user-workloads/crt-redhat-acm-tenant/release-acm-211/console-acm-211
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat AMQ Broker 7 amq-broker-bin.zip 7.14.1.CR2, amq-broker-maven-repository.zip 7.14.1.CR3
    affected: workaround, no fix available
  • Red Hat Ansible Automation Platform 2 automation-controller 4.5.35-1.el9ap
    affected: workaround, no fix planned “Will not fix”
  • Red Hat build of Apache Camel - HawtIO 4 rhaf-hawtio-maven-repository.zip Red Hat build of Apicurio Registry 3 apicurio/apicurio-registry-ui-rhel8, apicurio/apicurio-registry-ui-rhel9, apicurio/apicurio-registry-gitops-sync-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Build of Podman Desktop rh-podman-desktop.git 1.1.0
    affected: workaround, no fix available
  • Red Hat Ceph Storage 6 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +16 more Red Hat Ceph Storage 8 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +17 more Red Hat Ceph Storage 9 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +19 more
    affected: workaround, no fix available “Fix deferred”
show 23 more
  • Red Hat Data Grid 8 redhat-datagrid-maven-repository.zip 8.6.1.CR1 Red Hat Developer Hub 1 rhdh/red-hat-developer-hub-backstage-plugin-lightspeed
    affected: workaround, no fix available
  • Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +9 more Red Hat Enterprise Linux 9 grafana, grafana-selinux, grafana 12.4.3-2.el10 Red Hat Enterprise Linux 10 ceph, grafana 12.4.3-2.el10, cockpit-image-builder 110-1.el10
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-core-bff-rhel9, rhoai/odh-dashboard-operator-rhel9, rhoai/odh-mod-arch-agent-ops-rhel9 Red Hat OpenShift Container Platform 4 openshift4/ose-monitoring-plugin-rhel9 Red Hat OpenShift Container Platform 5 openshift5/ose-monitoring-plugin-rhel9
    affected: workaround, no fix available
  • Red Hat Openshift Data Foundation 4 odf4/odf-console-rhel9, odf4/ocs-client-console-rhel9, rhceph-dev/odf4-odf-console-rhel9, odf4/odf-multicluster-console-rhel9, rhceph-dev/odf4-ocs-client-console-rhel9, rhceph-dev/odf4-odf-multicluster-console-rhel9
    affected: workaround, no fix available, no fix planned “Out of support scope”
  • Red Hat OpenShift GitOps microshift-gitops 1.19.2-36.el9, openshift-gitops-1/argocd-rhel8
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin-rhel9, openshift-virtualization/konflux-builds/v4-18/kubevirt-console-plugin-rhel9
    affected: workaround, no fix available, no fix planned “Out of support scope”
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 1793661804, cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 1793823428
    fixed: vendor fix RHSA-2026:95591
  • Red Hat Advanced Cluster Security for Kubernetes 4.11 advanced-cluster-security/rhacs-main-rhel9 1789411320
    fixed: vendor fix RHSA-2026:67714
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 advanced-cluster-security/rhacs-main-rhel8 1789411269
    fixed: vendor fix RHSA-2026:67711
  • Red Hat Ansible Automation Platform 2.1 ansible-automation-platform/automation-portal 1788775748
    fixed: vendor fix RHSA-2026:65118
  • Red Hat Ansible Automation Platform 2.2 ansible-automation-platform/automation-portal 1788783591
    fixed: vendor fix RHSA-2026:65155
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-platform-ui 2.6.14-1.el9ap
    fixed: vendor fix RHSA-2026:71113
  • Red Hat Hardened Images grafana13.1 13.1.3-0.9.hum1, grafana13.2 13.2.1-0.6.hum1, grafana13.2 13.2.1-0.7.hum1, grafana12.4 12.4.10-0.7.hum1
    fixed: vendor fix RHSA-2026:70917
  • Red Hat OpenShift AI 2.25 rhoai/odh-dashboard-rhel9 1791853525, rhoai/odh-mod-arch-model-registry-rhel9 1791853432
    fixed: vendor fix RHSA-2026:87410
  • Red Hat OpenShift AI 3.4 rhoai/odh-dashboard-rhel9 1793001801, rhoai/odh-mod-arch-maas-rhel9 1791860708, rhoai/odh-mod-arch-automl-rhel9 1791861032, rhoai/odh-mod-arch-gen-ai-rhel9 1791861479, rhoai/odh-mod-arch-mlflow-rhel9 1791861383, rhoai/odh-mod-arch-autorag-rhel9 1791860994, +2 more
    fixed: vendor fix RHSA-2026:92510
  • Red Hat OpenShift AI 3.5 rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 1791825469
    fixed: vendor fix RHSA-2026:86891
  • Red Hat OpenShift Dev Spaces 3.30 devspaces/openvsx-rhel9 1787759145
    fixed: vendor fix RHSA-2026:62260
  • Red Hat OpenShift Dev Spaces 3.31 devspaces/code-rhel9 1792599388
    fixed: vendor fix RHSA-2026:90321
  • Red Hat OpenShift GitOps 1.20 openshift-gitops-1/argocd-rhel9 1793685630
    fixed: vendor fix RHSA-2026:94581
  • Red Hat OpenShift GitOps 1.21 openshift-gitops-1/argocd-rhel9 1793692411
    fixed: vendor fix RHSA-2026:94583
  • Red Hat OpenShift Service Mesh 3.3 openshift-service-mesh/kiali-rhel9 1789027395, openshift-service-mesh/kiali-ossmc-rhel9 1789050085
    fixed: vendor fix RHSA-2026:68690
  • Red Hat OpenShift Service Mesh 3.4 openshift-service-mesh/kiali-rhel9 1789021319, openshift-service-mesh/kiali-ossmc-rhel9 1789475294
    fixed: vendor fix RHSA-2026:68695
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/perses-rhel9 1793661985, cluster-observability-operator/perses-rhel9 1793825744, cluster-observability-operator/thanos-rhel9 1793660568, cluster-observability-operator/thanos-rhel9 1793821585, cluster-observability-operator/korrel8r-rhel9 1793661297, cluster-observability-operator/korrel8r-rhel9 1793822079, +42 more
    not affected: vulnerable code not present

30 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
2mo ago

Exploit prediction

0.39% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-11).

Exploits and checks

  • github.com https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CNA 4.0 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
npm dompurify
<3.4.13
3.4.13

Affected products

  • cure53 DOMPurify

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of cure53/DOMPurify published their own advisory on GitHub. Reviewed sources take precedence over it.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.