CVE-2026-75838

A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during IN_PLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of malicious scripts even after the HTML appears to be sanitized, leading to potential information disclosure or unauthorized actions.

This cross-site scripting flaw in DOMPurify affects Red Hat products that utilize the library for HTML sanitization. The vulnerability allows attackers to execute arbitrary JavaScript by exploiting incomplete neutralization of detached subtrees during IN_PLACE sanitization, but only when a non-default configuration involving an element-removal hook is in use and user interaction with specially crafted content occurs.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, avoid using DOMPurify with a custom IN_PLACE sanitization configuration that includes an element-removal hook. Default DOMPurify configurations are not affected by this flaw.