Every CVESearch/Get API key

CVE-2026-75838

DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

5.1 MediumFix available

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
None

Exploit likelihood

0.39%Up 0.1 points since Aug 19, 2026
90%50%10%1%

What each source reports

CVE List Score used5.1

DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

Record
CVE-2026-75838
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2026-606025.1

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

Record
EUVD-2026-60602
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-748c-f84h-hp2v5.1

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization...

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

Record
GHSA-748c-f84h-hp2v
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-79
Updated
2026-11-02
NVD5.1

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

Record
CVE-2026-75838
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-79
Updated
2026-11-02
OSV5.1

DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

Record
CVE-2026-75838
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
OSVDEBIAN-CVE-2026-758385.1

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

Record
DEBIAN-CVE-2026-75838
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 42 moreShow less
OSVRHSA-2026:675737.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:67573
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:709176.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:70917
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:709946.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:70994
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:711139.9

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Record
RHSA-2026:71113
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:719067.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:71906
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-758385.1

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

Record
UBUNTU-CVE-2026-75838
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Updated
2026-11-02
OSVCLSA-2026-1789139223No score

TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.2.7-tuxcare.2.

Record
CLSA-2026-1789139223
Updated
2026-11-02
OSVCLSA-2026-1789146579No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.6-tuxcare.8.

Record
CLSA-2026-1789146579
Updated
2026-11-02
OSVCLSA-2026-1789146735No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.2.3-tuxcare.4.

Record
CLSA-2026-1789146735
Updated
2026-11-02
OSVCLSA-2026-1789152222No score

TuxCare security update for dompurify (11 CVEs)

TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 2.3.0-tuxcare.5.

Record
CLSA-2026-1789152222
Updated
2026-11-02
OSVCLSA-2026-1789153936No score

TuxCare security update for dompurify (9 CVEs)

TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 2.4.0-tuxcare.5.

Record
CLSA-2026-1789153936
Updated
2026-11-02
OSVCLSA-2026-1789154068No score

TuxCare security update for dompurify (12 CVEs)

TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.0.3-tuxcare.5.

Record
CLSA-2026-1789154068
Updated
2026-11-02
OSVCLSA-2026-1789154458No score

TuxCare security update for dompurify (9 CVEs)

TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 2.4.7-tuxcare.5.

Record
CLSA-2026-1789154458
Updated
2026-11-02
OSVCLSA-2026-1789155227No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.5.9-tuxcare.7.

Record
CLSA-2026-1789155227
Updated
2026-11-02
OSVCLSA-2026-1789155659No score

TuxCare security update for dompurify (12 CVEs)

TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 2.4.3-tuxcare.8.

Record
CLSA-2026-1789155659
Updated
2026-11-02
OSVCLSA-2026-1789155876No score

TuxCare security update for dompurify (8 CVEs)

TuxCare rebuilt dompurify to address 8 CVEs. Fixed in 2.5.8-tuxcare.7.

Record
CLSA-2026-1789155876
Updated
2026-11-02
OSVCLSA-2026-1789404783No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.4.8-tuxcare.4.

Record
CLSA-2026-1789404783
Updated
2026-11-02
OSVCLSA-2026-1792150209No score

TuxCare security update for dompurify (9 CVEs)

TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 3.4.5-tuxcare.2.

Record
CLSA-2026-1792150209
Updated
2026-11-02
OSVCLSA-2026-1792155851No score

TuxCare security update for dompurify (12 CVEs)

TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.1.3-tuxcare.2.

Record
CLSA-2026-1792155851
Updated
2026-11-02
OSVCLSA-2026-1792156267No score

TuxCare security update for dompurify (9 CVEs)

TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 3.1.2-tuxcare.2.

Record
CLSA-2026-1792156267
Updated
2026-11-02
OSVCLSA-2026-1792156282No score

TuxCare security update for dompurify (11 CVEs)

TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.1.4-tuxcare.2.

Record
CLSA-2026-1792156282
Updated
2026-11-02
OSVCLSA-2026-1792156589No score

TuxCare security update for dompurify (10 CVEs)

TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.0.9-tuxcare.2.

Record
CLSA-2026-1792156589
Updated
2026-11-02
OSVCLSA-2026-1792156694No score

TuxCare security update for dompurify (11 CVEs)

TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.0.8-tuxcare.2.

Record
CLSA-2026-1792156694
Updated
2026-11-02
OSVCLSA-2026-1792157013No score

TuxCare security update for dompurify (13 CVEs)

TuxCare rebuilt dompurify to address 13 CVEs. Fixed in 3.1.0-tuxcare.2.

Record
CLSA-2026-1792157013
Updated
2026-11-02
OSVCLSA-2026-1792157113No score

TuxCare security update for dompurify (12 CVEs)

TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.0.11-tuxcare.2.

Record
CLSA-2026-1792157113
Updated
2026-11-02
OSVCLSA-2026-1792157349No score

TuxCare security update for dompurify (5 CVEs)

TuxCare rebuilt dompurify to address 5 CVEs. Fixed in 3.4.6-tuxcare.2.

Record
CLSA-2026-1792157349
Updated
2026-11-02
OSVCLSA-2026-1792157367No score

TuxCare security update for dompurify (4 CVEs)

TuxCare rebuilt dompurify to address 4 CVEs. Fixed in 3.4.7-tuxcare.2.

Record
CLSA-2026-1792157367
Updated
2026-11-02
OSVCLSA-2026-1792159109No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.4.11-tuxcare.2.

Record
CLSA-2026-1792159109
Updated
2026-11-02
OSVCLSA-2026-1792159229No score

TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.10-tuxcare.2.

Record
CLSA-2026-1792159229
Updated
2026-11-02
OSVCLSA-2026-1792161408No score

TuxCare security update for dompurify (8 CVEs)

TuxCare rebuilt dompurify to address 8 CVEs. Fixed in 3.1.1-tuxcare.2.

Record
CLSA-2026-1792161408
Updated
2026-11-02
OSVCLSA-2026-1792424339No score

TuxCare security update for dompurify (10 CVEs)

TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 2.0.8-tuxcare.3.

Record
CLSA-2026-1792424339
Updated
2026-11-02
OSVCLSA-2026-1792424561No score

TuxCare security update for dompurify (9 CVEs)

TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 3.3.3-tuxcare.3.

Record
CLSA-2026-1792424561
Updated
2026-11-02
OSVCLSA-2026-1792424669No score

TuxCare security update for dompurify (9 CVEs)

TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 3.2.6-tuxcare.3.

Record
CLSA-2026-1792424669
Updated
2026-11-02
OSVCLSA-2026-1792424891No score

TuxCare security update for dompurify (13 CVEs)

TuxCare rebuilt dompurify to address 13 CVEs. Fixed in 2.3.10-tuxcare.3.

Record
CLSA-2026-1792424891
Updated
2026-11-02
OSVCLSA-2026-1792486117No score

TuxCare security update for dompurify (10 CVEs)

TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.0.1-tuxcare.3.

Record
CLSA-2026-1792486117
Updated
2026-11-02
OSVCLSA-2026-1792486837No score

TuxCare security update for dompurify (10 CVEs)

TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.0.2-tuxcare.3.

Record
CLSA-2026-1792486837
Updated
2026-11-02
OSVCLSA-2026-1792497323No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.9-tuxcare.3.

Record
CLSA-2026-1792497323
Updated
2026-11-02
OSVCLSA-2026-1792509522No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.12-tuxcare.1.

Record
CLSA-2026-1792509522
Updated
2026-11-02
OSVCLSA-2026-1792929243No score

TuxCare security update for dompurify (7 CVEs)

TuxCare rebuilt dompurify to address 7 CVEs. Fixed in 3.0.6-tuxcare.5.

Record
CLSA-2026-1792929243
Updated
2026-11-02
OSVCLSA-2026-1793101871No score

TuxCare security update for dompurify (11 CVEs)

TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.0.5-tuxcare.4.

Record
CLSA-2026-1793101871
Updated
2026-11-02
OSVCLSA-2026-1793102041No score

TuxCare security update for dompurify (11 CVEs)

TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.0.4-tuxcare.4.

Record
CLSA-2026-1793102041
Updated
2026-11-02
OSVCLSA-2026-1793867540No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.3.3-tuxcare.6.

Record
CLSA-2026-1793867540
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dompurify
TuxCare:npm
From an advisory covering 3 CVEs
3.2.7-tuxcare.0 up to 3.2.7-tuxcare.2, plus listed versions
3.2.73.2.7-tuxcare.1
3.2.7-tuxcare.2
dompurify
TuxCare:npm
3.1.6-tuxcare.0 up to 3.1.6-tuxcare.8, plus listed versions
3.1.63.1.6-tuxcare.13.1.6-tuxcare.23.1.6-tuxcare.33.1.6-tuxcare.43.1.6-tuxcare.53.1.6-tuxcare.63.1.6-tuxcare.7
3.1.6-tuxcare.8
dompurify
TuxCare:npm
3.2.3-tuxcare.0 up to 3.2.3-tuxcare.4, plus listed versions
3.2.33.2.3-tuxcare.13.2.3-tuxcare.23.2.3-tuxcare.3
3.2.3-tuxcare.4
dompurify
TuxCare:npm
From an advisory covering 10 CVEs
2.3.0-tuxcare.0 up to 2.3.0-tuxcare.5, plus listed versions
2.3.02.3.0-tuxcare.12.3.0-tuxcare.22.3.0-tuxcare.32.3.0-tuxcare.4
2.3.0-tuxcare.5
dompurify
TuxCare:npm
From an advisory covering 8 CVEs
2.4.0-tuxcare.0 up to 2.4.0-tuxcare.5, plus listed versions
2.4.02.4.0-tuxcare.12.4.0-tuxcare.22.4.0-tuxcare.32.4.0-tuxcare.4
2.4.0-tuxcare.5
dompurify
TuxCare:npm
From an advisory covering 11 CVEs
3.0.3-tuxcare.0 up to 3.0.3-tuxcare.5, plus listed versions
3.0.33.0.3-tuxcare.13.0.3-tuxcare.23.0.3-tuxcare.33.0.3-tuxcare.4
3.0.3-tuxcare.5
dompurify
TuxCare:npm
From an advisory covering 8 CVEs
2.4.7-tuxcare.0 up to 2.4.7-tuxcare.5, plus listed versions
2.4.72.4.7-tuxcare.12.4.7-tuxcare.22.4.7-tuxcare.32.4.7-tuxcare.4
2.4.7-tuxcare.5
dompurify
TuxCare:npm
2.5.9-tuxcare.0 up to 2.5.9-tuxcare.7, plus listed versions
2.5.92.5.9-tuxcare.12.5.9-tuxcare.22.5.9-tuxcare.32.5.9-tuxcare.42.5.9-tuxcare.52.5.9-tuxcare.6
2.5.9-tuxcare.7
dompurify
TuxCare:npm
From an advisory covering 11 CVEs
2.4.3-tuxcare.0 up to 2.4.3-tuxcare.8, plus listed versions
2.4.32.4.3-tuxcare.12.4.3-tuxcare.22.4.3-tuxcare.32.4.3-tuxcare.42.4.3-tuxcare.52.4.3-tuxcare.62.4.3-tuxcare.7
2.4.3-tuxcare.8
dompurify
TuxCare:npm
From an advisory covering 7 CVEs
2.5.8-tuxcare.0 up to 2.5.8-tuxcare.7, plus listed versions
2.5.82.5.8-tuxcare.12.5.8-tuxcare.22.5.8-tuxcare.32.5.8-tuxcare.42.5.8-tuxcare.52.5.8-tuxcare.6
2.5.8-tuxcare.7
Show 57 moreShow less
Affected packages
PackageAffectedFixed
dompurify
TuxCare:npm
From an advisory covering 2 CVEs
3.4.8-tuxcare.0 up to 3.4.8-tuxcare.4, plus listed versions
3.4.83.4.8-tuxcare.13.4.8-tuxcare.23.4.8-tuxcare.3
3.4.8-tuxcare.4
dompurify
TuxCare:npm
From an advisory covering 6 CVEs
3.4.5-tuxcare.0 up to 3.4.5-tuxcare.2, plus listed versions
3.4.53.4.5-tuxcare.1
3.4.5-tuxcare.2
dompurify
TuxCare:npm
From an advisory covering 12 CVEs
3.1.3-tuxcare.0 up to 3.1.3-tuxcare.2, plus listed versions
3.1.33.1.3-tuxcare.1
3.1.3-tuxcare.2
dompurify
TuxCare:npm
From an advisory covering 9 CVEs
3.1.2-tuxcare.0 up to 3.1.2-tuxcare.2, plus listed versions
3.1.23.1.2-tuxcare.1
3.1.2-tuxcare.2
dompurify
TuxCare:npm
From an advisory covering 11 CVEs
3.1.4-tuxcare.0 up to 3.1.4-tuxcare.2, plus listed versions
3.1.43.1.4-tuxcare.1
3.1.4-tuxcare.2
dompurify
TuxCare:npm
From an advisory covering 10 CVEs
3.0.9-tuxcare.0 up to 3.0.9-tuxcare.2, plus listed versions
3.0.93.0.9-tuxcare.1
3.0.9-tuxcare.2
dompurify
TuxCare:npm
From an advisory covering 11 CVEs
3.0.8-tuxcare.0 up to 3.0.8-tuxcare.2, plus listed versions
3.0.83.0.8-tuxcare.1
3.0.8-tuxcare.2
dompurify
TuxCare:npm
From an advisory covering 13 CVEs
3.1.0-tuxcare.0 up to 3.1.0-tuxcare.2, plus listed versions
3.1.03.1.0-tuxcare.1
3.1.0-tuxcare.2
dompurify
TuxCare:npm
From an advisory covering 12 CVEs
3.0.11-tuxcare.0 up to 3.0.11-tuxcare.2, plus listed versions
3.0.113.0.11-tuxcare.1
3.0.11-tuxcare.2
dompurify
TuxCare:npm
From an advisory covering 4 CVEs
3.4.6-tuxcare.0 up to 3.4.6-tuxcare.2, plus listed versions
3.4.63.4.6-tuxcare.1
3.4.6-tuxcare.2
dompurify
TuxCare:npm
From an advisory covering 3 CVEs
3.4.7-tuxcare.0 up to 3.4.7-tuxcare.2, plus listed versions
3.4.73.4.7-tuxcare.1
3.4.7-tuxcare.2
dompurify
TuxCare:npm
From an advisory covering 2 CVEs
3.4.11-tuxcare.0 up to 3.4.11-tuxcare.2, plus listed versions
3.4.113.4.11-tuxcare.1
3.4.11-tuxcare.2
dompurify
TuxCare:npm
From an advisory covering 3 CVEs
3.4.10-tuxcare.0 up to 3.4.10-tuxcare.2, plus listed versions
3.4.103.4.10-tuxcare.1
3.4.10-tuxcare.2
dompurify
TuxCare:npm
From an advisory covering 8 CVEs
3.1.1-tuxcare.0 up to 3.1.1-tuxcare.2, plus listed versions
3.1.13.1.1-tuxcare.1
3.1.1-tuxcare.2
dompurify
TuxCare:npm
From an advisory covering 10 CVEs
2.0.8-tuxcare.0 up to 2.0.8-tuxcare.3, plus listed versions
2.0.82.0.8-tuxcare.12.0.8-tuxcare.2
2.0.8-tuxcare.3
dompurify
TuxCare:npm
From an advisory covering 9 CVEs
3.3.3-tuxcare.0 up to 3.3.3-tuxcare.3, plus listed versions
3.3.33.3.3-tuxcare.13.3.3-tuxcare.2
3.3.3-tuxcare.3
dompurify
TuxCare:npm
From an advisory covering 9 CVEs
3.2.6-tuxcare.0 up to 3.2.6-tuxcare.3, plus listed versions
3.2.63.2.6-tuxcare.13.2.6-tuxcare.2
3.2.6-tuxcare.3
dompurify
TuxCare:npm
From an advisory covering 13 CVEs
2.3.10-tuxcare.0 up to 2.3.10-tuxcare.3, plus listed versions
2.3.102.3.10-tuxcare.12.3.10-tuxcare.2
2.3.10-tuxcare.3
dompurify
TuxCare:npm
From an advisory covering 10 CVEs
3.0.1-tuxcare.0 up to 3.0.1-tuxcare.3, plus listed versions
3.0.13.0.1-tuxcare.13.0.1-tuxcare.2
3.0.1-tuxcare.3
dompurify
TuxCare:npm
From an advisory covering 10 CVEs
3.0.2-tuxcare.0 up to 3.0.2-tuxcare.3, plus listed versions
3.0.23.0.2-tuxcare.13.0.2-tuxcare.2
3.0.2-tuxcare.3
dompurify
TuxCare:npm
3.4.9-tuxcare.0 up to 3.4.9-tuxcare.3, plus listed versions
3.4.93.4.9-tuxcare.13.4.9-tuxcare.2
3.4.9-tuxcare.3
dompurify
TuxCare:npm
3.4.12-tuxcare.0 up to 3.4.12-tuxcare.1, plus listed versions
3.4.12
3.4.12-tuxcare.1
dompurify
TuxCare:npm
From an advisory covering 5 CVEs
3.0.6-tuxcare.0 up to 3.0.6-tuxcare.5, plus listed versions
3.0.63.0.6-tuxcare.13.0.6-tuxcare.23.0.6-tuxcare.33.0.6-tuxcare.4
3.0.6-tuxcare.5
dompurify
TuxCare:npm
From an advisory covering 10 CVEs
3.0.5-tuxcare.0 up to 3.0.5-tuxcare.4, plus listed versions
3.0.53.0.5-tuxcare.13.0.5-tuxcare.23.0.5-tuxcare.3
3.0.5-tuxcare.4
dompurify
TuxCare:npm
From an advisory covering 10 CVEs
3.0.4-tuxcare.0 up to 3.0.4-tuxcare.4, plus listed versions
3.0.43.0.4-tuxcare.13.0.4-tuxcare.23.0.4-tuxcare.3
3.0.4-tuxcare.4
dompurify
TuxCare:npm
2.3.3-tuxcare.0 up to 2.3.3-tuxcare.6, plus listed versions
2.3.32.3.3-tuxcare.12.3.3-tuxcare.22.3.3-tuxcare.32.3.3-tuxcare.42.3.3-tuxcare.5
2.3.3-tuxcare.6
node-dompurify
Debian:12
All versions, plus listed versions
2.4.1+dfsg+~2.4.0-12.4.1+dfsg+~2.4.0-22.4.1+dfsg+~2.4.0-2+deb12u13.0.9+dfsg+~3.0.5-13.1.6+dfsg+~3.0.5-1
Show 13 moreShow less
3.1.7+dfsg+~3.0.5-13.1.7+dfsg+~3.0.5-23.2.5+dfsg-13.3.2+dfsg-13.3.3+dfsg-13.3.3+dfsg-23.4.1+dfsg-13.4.12+dfsg-13.4.13+dfsg-13.4.13+dfsg-23.4.16+dfsg-13.4.2+dfsg-13.4.5+dfsg-1
None known
node-dompurify
Debian:13
All versions, plus listed versions
3.1.7+dfsg+~3.0.5-23.2.5+dfsg-13.3.2+dfsg-13.3.3+dfsg-13.3.3+dfsg-2
Show 7 moreShow less
3.4.1+dfsg-13.4.12+dfsg-13.4.13+dfsg-13.4.13+dfsg-23.4.16+dfsg-13.4.2+dfsg-13.4.5+dfsg-1
None known
node-dompurify
Debian:14
before 3.4.13+dfsg-1, plus listed versions
3.1.7+dfsg+~3.0.5-23.2.5+dfsg-13.3.2+dfsg-13.3.3+dfsg-13.3.3+dfsg-2
Show 4 moreShow less
3.4.1+dfsg-13.4.12+dfsg-13.4.2+dfsg-13.4.5+dfsg-1
3.4.13+dfsg-1
grafana13.1
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
before 0:13.1.3-0.9.hum1
0:13.1.3-0.9.hum1
grafana12.4
Red Hat:hummingbird:1
before 0:12.4.10-0.7.hum1
0:12.4.10-0.7.hum1
grafana13.2
Red Hat:hummingbird:1
before 0:13.2.1-0.6.hum1
0:13.2.1-0.6.hum1
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 61 CVEs
before 0:4.7.17-1.el9ap
0:4.7.17-1.el9ap
receptor
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 61 CVEs
before 0:1.6.8-1.el10ap
0:1.6.8-1.el10ap
receptor
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 61 CVEs
before 0:1.6.8-1.el9ap
0:1.6.8-1.el9ap
receptor
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 61 CVEs
before 0:1.6.8-1.el9ap
0:1.6.8-1.el9ap
automation-gateway-proxy-server
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 61 CVEs
before 0:2.6.17-3.el9ap
0:2.6.17-3.el9ap
receptor
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 61 CVEs
before 0:1.6.8-1.el9ap
0:1.6.8-1.el9ap
python-sqlparse
Red Hat:ansible_automation_platform_developer:2.6::el10
From an advisory covering 61 CVEs
before 0:0.6.0-1.el10ap
0:0.6.0-1.el10ap
python3-sqlparse
Red Hat:ansible_automation_platform_developer:2.6::el10
From an advisory covering 61 CVEs
before 0:0.6.0-1.el10ap
0:0.6.0-1.el10ap
python-sqlparse
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 61 CVEs
before 0:0.6.0-1.el10ap
0:0.6.0-1.el10ap
python3-sqlparse
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 61 CVEs
before 0:0.6.0-1.el10ap
0:0.6.0-1.el10ap
python3.12-sqlparse
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 61 CVEs
before 0:0.6.0-1.el9ap
0:0.6.0-1.el9ap
python3.12-sqlparse
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 61 CVEs
before 0:0.6.0-1.el9ap
0:0.6.0-1.el9ap
automation-platform-ui
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 61 CVEs
before 0:2.6.14-1.el9ap
0:2.6.14-1.el9ap
automation-controller
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 61 CVEs
before 0:4.7.17-1.el9ap
0:4.7.17-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 61 CVEs
before 0:4.7.17-1.el9ap
0:4.7.17-1.el9ap
automation-controller
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 61 CVEs
before 0:4.7.17-1.el9ap
0:4.7.17-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 61 CVEs
before 0:4.7.17-1.el9ap
0:4.7.17-1.el9ap
automation-controller-server
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 61 CVEs
before 0:4.7.17-1.el9ap
0:4.7.17-1.el9ap
automation-controller-ui
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 61 CVEs
before 0:4.7.17-1.el9ap
0:4.7.17-1.el9ap
python3.12-gitpython
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 61 CVEs
before 0:3.1.60-1.el9ap
0:3.1.60-1.el9ap
grafana13.2
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
before 0:13.2.1-0.7.hum1
0:13.2.1-0.7.hum1
node-dompurify
Ubuntu:22.04:LTS
All versions, plus listed versions
2.3.0+dfsg-22.3.3+dfsg-1
None known
node-dompurify
Ubuntu:24.04:LTS
All versions, plus listed versions
2.4.1+dfsg+~2.4.0-13.0.9+dfsg+~3.0.5-1
None known
node-dompurify
Ubuntu:26.10
All versions, plus listed versions
3.3.3+dfsg-13.4.2+dfsg-13.4.5+dfsg-13.4.12+dfsg-13.4.13+dfsg-13.4.13+dfsg-2
None known
node-dompurify
Ubuntu:26.04:LTS
All versions, plus listed versions
3.1.7+dfsg+~3.0.5-23.3.3+dfsg-1
None known

History

History
RecordedChangedSources
aliases
affected
affected, aliases, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-75838 is a medium vulnerability (CVSS 5.1) in Cure53 Dompurify, published August 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 34th percentile. Fixed in dompurify 3.1.6-tuxcare.8.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 170 references. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open