CVE-2026-75838
DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
- Record
CVE-2026-75838- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-60602
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
- Record
EUVD-2026-60602- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-748c-f84h-hp2v
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization...
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
- Record
GHSA-748c-f84h-hp2v- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
- Record
CVE-2026-75838- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
- Record
CVE-2026-75838- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-75838
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
- Record
DEBIAN-CVE-2026-75838- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
Show 42 moreShow less
OSVRHSA-2026:67573
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:67573- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2026:70917
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:70917- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2026:70994
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:70994- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2026:71113
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Record
RHSA-2026:71113- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:71906
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:71906- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-75838
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.
- Record
UBUNTU-CVE-2026-75838- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Updated
- 2026-11-02
OSVCLSA-2026-1789139223 No score
TuxCare security update for dompurify (3 CVEs)
TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.2.7-tuxcare.2.
- Record
CLSA-2026-1789139223- Updated
- 2026-11-02
OSVCLSA-2026-1789146579 No score
TuxCare security update for dompurify (1 CVE)
TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.6-tuxcare.8.
- Record
CLSA-2026-1789146579- Updated
- 2026-11-02
OSVCLSA-2026-1789146735 No score
TuxCare security update for dompurify (1 CVE)
TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.2.3-tuxcare.4.
- Record
CLSA-2026-1789146735- Updated
- 2026-11-02
OSVCLSA-2026-1789152222 No score
TuxCare security update for dompurify (11 CVEs)
TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 2.3.0-tuxcare.5.
- Record
CLSA-2026-1789152222- Updated
- 2026-11-02
OSVCLSA-2026-1789153936 No score
TuxCare security update for dompurify (9 CVEs)
TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 2.4.0-tuxcare.5.
- Record
CLSA-2026-1789153936- Updated
- 2026-11-02
OSVCLSA-2026-1789154068 No score
TuxCare security update for dompurify (12 CVEs)
TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.0.3-tuxcare.5.
- Record
CLSA-2026-1789154068- Updated
- 2026-11-02
OSVCLSA-2026-1789154458 No score
TuxCare security update for dompurify (9 CVEs)
TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 2.4.7-tuxcare.5.
- Record
CLSA-2026-1789154458- Updated
- 2026-11-02
OSVCLSA-2026-1789155227 No score
TuxCare security update for dompurify (1 CVE)
TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.5.9-tuxcare.7.
- Record
CLSA-2026-1789155227- Updated
- 2026-11-02
OSVCLSA-2026-1789155659 No score
TuxCare security update for dompurify (12 CVEs)
TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 2.4.3-tuxcare.8.
- Record
CLSA-2026-1789155659- Updated
- 2026-11-02
OSVCLSA-2026-1789155876 No score
TuxCare security update for dompurify (8 CVEs)
TuxCare rebuilt dompurify to address 8 CVEs. Fixed in 2.5.8-tuxcare.7.
- Record
CLSA-2026-1789155876- Updated
- 2026-11-02
OSVCLSA-2026-1789404783 No score
TuxCare security update for dompurify (2 CVEs)
TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.4.8-tuxcare.4.
- Record
CLSA-2026-1789404783- Updated
- 2026-11-02
OSVCLSA-2026-1792150209 No score
TuxCare security update for dompurify (9 CVEs)
TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 3.4.5-tuxcare.2.
- Record
CLSA-2026-1792150209- Updated
- 2026-11-02
OSVCLSA-2026-1792155851 No score
TuxCare security update for dompurify (12 CVEs)
TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.1.3-tuxcare.2.
- Record
CLSA-2026-1792155851- Updated
- 2026-11-02
OSVCLSA-2026-1792156267 No score
TuxCare security update for dompurify (9 CVEs)
TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 3.1.2-tuxcare.2.
- Record
CLSA-2026-1792156267- Updated
- 2026-11-02
OSVCLSA-2026-1792156282 No score
TuxCare security update for dompurify (11 CVEs)
TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.1.4-tuxcare.2.
- Record
CLSA-2026-1792156282- Updated
- 2026-11-02
OSVCLSA-2026-1792156589 No score
TuxCare security update for dompurify (10 CVEs)
TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.0.9-tuxcare.2.
- Record
CLSA-2026-1792156589- Updated
- 2026-11-02
OSVCLSA-2026-1792156694 No score
TuxCare security update for dompurify (11 CVEs)
TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.0.8-tuxcare.2.
- Record
CLSA-2026-1792156694- Updated
- 2026-11-02
OSVCLSA-2026-1792157013 No score
TuxCare security update for dompurify (13 CVEs)
TuxCare rebuilt dompurify to address 13 CVEs. Fixed in 3.1.0-tuxcare.2.
- Record
CLSA-2026-1792157013- Updated
- 2026-11-02
OSVCLSA-2026-1792157113 No score
TuxCare security update for dompurify (12 CVEs)
TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.0.11-tuxcare.2.
- Record
CLSA-2026-1792157113- Updated
- 2026-11-02
OSVCLSA-2026-1792157349 No score
TuxCare security update for dompurify (5 CVEs)
TuxCare rebuilt dompurify to address 5 CVEs. Fixed in 3.4.6-tuxcare.2.
- Record
CLSA-2026-1792157349- Updated
- 2026-11-02
OSVCLSA-2026-1792157367 No score
TuxCare security update for dompurify (4 CVEs)
TuxCare rebuilt dompurify to address 4 CVEs. Fixed in 3.4.7-tuxcare.2.
- Record
CLSA-2026-1792157367- Updated
- 2026-11-02
OSVCLSA-2026-1792159109 No score
TuxCare security update for dompurify (2 CVEs)
TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.4.11-tuxcare.2.
- Record
CLSA-2026-1792159109- Updated
- 2026-11-02
OSVCLSA-2026-1792159229 No score
TuxCare security update for dompurify (3 CVEs)
TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.10-tuxcare.2.
- Record
CLSA-2026-1792159229- Updated
- 2026-11-02
OSVCLSA-2026-1792161408 No score
TuxCare security update for dompurify (8 CVEs)
TuxCare rebuilt dompurify to address 8 CVEs. Fixed in 3.1.1-tuxcare.2.
- Record
CLSA-2026-1792161408- Updated
- 2026-11-02
OSVCLSA-2026-1792424339 No score
TuxCare security update for dompurify (10 CVEs)
TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 2.0.8-tuxcare.3.
- Record
CLSA-2026-1792424339- Updated
- 2026-11-02
OSVCLSA-2026-1792424561 No score
TuxCare security update for dompurify (9 CVEs)
TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 3.3.3-tuxcare.3.
- Record
CLSA-2026-1792424561- Updated
- 2026-11-02
OSVCLSA-2026-1792424669 No score
TuxCare security update for dompurify (9 CVEs)
TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 3.2.6-tuxcare.3.
- Record
CLSA-2026-1792424669- Updated
- 2026-11-02
OSVCLSA-2026-1792424891 No score
TuxCare security update for dompurify (13 CVEs)
TuxCare rebuilt dompurify to address 13 CVEs. Fixed in 2.3.10-tuxcare.3.
- Record
CLSA-2026-1792424891- Updated
- 2026-11-02
OSVCLSA-2026-1792486117 No score
TuxCare security update for dompurify (10 CVEs)
TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.0.1-tuxcare.3.
- Record
CLSA-2026-1792486117- Updated
- 2026-11-02
OSVCLSA-2026-1792486837 No score
TuxCare security update for dompurify (10 CVEs)
TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.0.2-tuxcare.3.
- Record
CLSA-2026-1792486837- Updated
- 2026-11-02
OSVCLSA-2026-1792497323 No score
TuxCare security update for dompurify (1 CVE)
TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.9-tuxcare.3.
- Record
CLSA-2026-1792497323- Updated
- 2026-11-02
OSVCLSA-2026-1792509522 No score
TuxCare security update for dompurify (1 CVE)
TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.12-tuxcare.1.
- Record
CLSA-2026-1792509522- Updated
- 2026-11-02
OSVCLSA-2026-1792929243 No score
TuxCare security update for dompurify (7 CVEs)
TuxCare rebuilt dompurify to address 7 CVEs. Fixed in 3.0.6-tuxcare.5.
- Record
CLSA-2026-1792929243- Updated
- 2026-11-02
OSVCLSA-2026-1793101871 No score
TuxCare security update for dompurify (11 CVEs)
TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.0.5-tuxcare.4.
- Record
CLSA-2026-1793101871- Updated
- 2026-11-02
OSVCLSA-2026-1793102041 No score
TuxCare security update for dompurify (11 CVEs)
TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.0.4-tuxcare.4.
- Record
CLSA-2026-1793102041- Updated
- 2026-11-02
OSVCLSA-2026-1793867540 No score
TuxCare security update for dompurify (1 CVE)
TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.3.3-tuxcare.6.
- Record
CLSA-2026-1793867540- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dompurifyTuxCare:npm From an advisory covering 3 CVEs |
3.2.7-tuxcare.0 up to 3.2.7-tuxcare.2, plus listed versions 3.2.73.2.7-tuxcare.1 |
3.2.7-tuxcare.2 |
dompurifyTuxCare:npm |
3.1.6-tuxcare.0 up to 3.1.6-tuxcare.8, plus listed versions 3.1.63.1.6-tuxcare.13.1.6-tuxcare.23.1.6-tuxcare.33.1.6-tuxcare.43.1.6-tuxcare.53.1.6-tuxcare.63.1.6-tuxcare.7 |
3.1.6-tuxcare.8 |
dompurifyTuxCare:npm |
3.2.3-tuxcare.0 up to 3.2.3-tuxcare.4, plus listed versions 3.2.33.2.3-tuxcare.13.2.3-tuxcare.23.2.3-tuxcare.3 |
3.2.3-tuxcare.4 |
dompurifyTuxCare:npm From an advisory covering 10 CVEs |
2.3.0-tuxcare.0 up to 2.3.0-tuxcare.5, plus listed versions 2.3.02.3.0-tuxcare.12.3.0-tuxcare.22.3.0-tuxcare.32.3.0-tuxcare.4 |
2.3.0-tuxcare.5 |
dompurifyTuxCare:npm From an advisory covering 8 CVEs |
2.4.0-tuxcare.0 up to 2.4.0-tuxcare.5, plus listed versions 2.4.02.4.0-tuxcare.12.4.0-tuxcare.22.4.0-tuxcare.32.4.0-tuxcare.4 |
2.4.0-tuxcare.5 |
dompurifyTuxCare:npm From an advisory covering 11 CVEs |
3.0.3-tuxcare.0 up to 3.0.3-tuxcare.5, plus listed versions 3.0.33.0.3-tuxcare.13.0.3-tuxcare.23.0.3-tuxcare.33.0.3-tuxcare.4 |
3.0.3-tuxcare.5 |
dompurifyTuxCare:npm From an advisory covering 8 CVEs |
2.4.7-tuxcare.0 up to 2.4.7-tuxcare.5, plus listed versions 2.4.72.4.7-tuxcare.12.4.7-tuxcare.22.4.7-tuxcare.32.4.7-tuxcare.4 |
2.4.7-tuxcare.5 |
dompurifyTuxCare:npm |
2.5.9-tuxcare.0 up to 2.5.9-tuxcare.7, plus listed versions 2.5.92.5.9-tuxcare.12.5.9-tuxcare.22.5.9-tuxcare.32.5.9-tuxcare.42.5.9-tuxcare.52.5.9-tuxcare.6 |
2.5.9-tuxcare.7 |
dompurifyTuxCare:npm From an advisory covering 11 CVEs |
2.4.3-tuxcare.0 up to 2.4.3-tuxcare.8, plus listed versions 2.4.32.4.3-tuxcare.12.4.3-tuxcare.22.4.3-tuxcare.32.4.3-tuxcare.42.4.3-tuxcare.52.4.3-tuxcare.62.4.3-tuxcare.7 |
2.4.3-tuxcare.8 |
dompurifyTuxCare:npm From an advisory covering 7 CVEs |
2.5.8-tuxcare.0 up to 2.5.8-tuxcare.7, plus listed versions 2.5.82.5.8-tuxcare.12.5.8-tuxcare.22.5.8-tuxcare.32.5.8-tuxcare.42.5.8-tuxcare.52.5.8-tuxcare.6 |
2.5.8-tuxcare.7 |
Show 57 moreShow less
| Package | Affected | Fixed |
|---|---|---|
dompurifyTuxCare:npm From an advisory covering 2 CVEs |
3.4.8-tuxcare.0 up to 3.4.8-tuxcare.4, plus listed versions 3.4.83.4.8-tuxcare.13.4.8-tuxcare.23.4.8-tuxcare.3 |
3.4.8-tuxcare.4 |
dompurifyTuxCare:npm From an advisory covering 6 CVEs |
3.4.5-tuxcare.0 up to 3.4.5-tuxcare.2, plus listed versions 3.4.53.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
dompurifyTuxCare:npm From an advisory covering 12 CVEs |
3.1.3-tuxcare.0 up to 3.1.3-tuxcare.2, plus listed versions 3.1.33.1.3-tuxcare.1 |
3.1.3-tuxcare.2 |
dompurifyTuxCare:npm From an advisory covering 9 CVEs |
3.1.2-tuxcare.0 up to 3.1.2-tuxcare.2, plus listed versions 3.1.23.1.2-tuxcare.1 |
3.1.2-tuxcare.2 |
dompurifyTuxCare:npm From an advisory covering 11 CVEs |
3.1.4-tuxcare.0 up to 3.1.4-tuxcare.2, plus listed versions 3.1.43.1.4-tuxcare.1 |
3.1.4-tuxcare.2 |
dompurifyTuxCare:npm From an advisory covering 10 CVEs |
3.0.9-tuxcare.0 up to 3.0.9-tuxcare.2, plus listed versions 3.0.93.0.9-tuxcare.1 |
3.0.9-tuxcare.2 |
dompurifyTuxCare:npm From an advisory covering 11 CVEs |
3.0.8-tuxcare.0 up to 3.0.8-tuxcare.2, plus listed versions 3.0.83.0.8-tuxcare.1 |
3.0.8-tuxcare.2 |
dompurifyTuxCare:npm From an advisory covering 13 CVEs |
3.1.0-tuxcare.0 up to 3.1.0-tuxcare.2, plus listed versions 3.1.03.1.0-tuxcare.1 |
3.1.0-tuxcare.2 |
dompurifyTuxCare:npm From an advisory covering 12 CVEs |
3.0.11-tuxcare.0 up to 3.0.11-tuxcare.2, plus listed versions 3.0.113.0.11-tuxcare.1 |
3.0.11-tuxcare.2 |
dompurifyTuxCare:npm From an advisory covering 4 CVEs |
3.4.6-tuxcare.0 up to 3.4.6-tuxcare.2, plus listed versions 3.4.63.4.6-tuxcare.1 |
3.4.6-tuxcare.2 |
dompurifyTuxCare:npm From an advisory covering 3 CVEs |
3.4.7-tuxcare.0 up to 3.4.7-tuxcare.2, plus listed versions 3.4.73.4.7-tuxcare.1 |
3.4.7-tuxcare.2 |
dompurifyTuxCare:npm From an advisory covering 2 CVEs |
3.4.11-tuxcare.0 up to 3.4.11-tuxcare.2, plus listed versions 3.4.113.4.11-tuxcare.1 |
3.4.11-tuxcare.2 |
dompurifyTuxCare:npm From an advisory covering 3 CVEs |
3.4.10-tuxcare.0 up to 3.4.10-tuxcare.2, plus listed versions 3.4.103.4.10-tuxcare.1 |
3.4.10-tuxcare.2 |
dompurifyTuxCare:npm From an advisory covering 8 CVEs |
3.1.1-tuxcare.0 up to 3.1.1-tuxcare.2, plus listed versions 3.1.13.1.1-tuxcare.1 |
3.1.1-tuxcare.2 |
dompurifyTuxCare:npm From an advisory covering 10 CVEs |
2.0.8-tuxcare.0 up to 2.0.8-tuxcare.3, plus listed versions 2.0.82.0.8-tuxcare.12.0.8-tuxcare.2 |
2.0.8-tuxcare.3 |
dompurifyTuxCare:npm From an advisory covering 9 CVEs |
3.3.3-tuxcare.0 up to 3.3.3-tuxcare.3, plus listed versions 3.3.33.3.3-tuxcare.13.3.3-tuxcare.2 |
3.3.3-tuxcare.3 |
dompurifyTuxCare:npm From an advisory covering 9 CVEs |
3.2.6-tuxcare.0 up to 3.2.6-tuxcare.3, plus listed versions 3.2.63.2.6-tuxcare.13.2.6-tuxcare.2 |
3.2.6-tuxcare.3 |
dompurifyTuxCare:npm From an advisory covering 13 CVEs |
2.3.10-tuxcare.0 up to 2.3.10-tuxcare.3, plus listed versions 2.3.102.3.10-tuxcare.12.3.10-tuxcare.2 |
2.3.10-tuxcare.3 |
dompurifyTuxCare:npm From an advisory covering 10 CVEs |
3.0.1-tuxcare.0 up to 3.0.1-tuxcare.3, plus listed versions 3.0.13.0.1-tuxcare.13.0.1-tuxcare.2 |
3.0.1-tuxcare.3 |
dompurifyTuxCare:npm From an advisory covering 10 CVEs |
3.0.2-tuxcare.0 up to 3.0.2-tuxcare.3, plus listed versions 3.0.23.0.2-tuxcare.13.0.2-tuxcare.2 |
3.0.2-tuxcare.3 |
dompurifyTuxCare:npm |
3.4.9-tuxcare.0 up to 3.4.9-tuxcare.3, plus listed versions 3.4.93.4.9-tuxcare.13.4.9-tuxcare.2 |
3.4.9-tuxcare.3 |
dompurifyTuxCare:npm |
3.4.12-tuxcare.0 up to 3.4.12-tuxcare.1, plus listed versions 3.4.12 |
3.4.12-tuxcare.1 |
dompurifyTuxCare:npm From an advisory covering 5 CVEs |
3.0.6-tuxcare.0 up to 3.0.6-tuxcare.5, plus listed versions 3.0.63.0.6-tuxcare.13.0.6-tuxcare.23.0.6-tuxcare.33.0.6-tuxcare.4 |
3.0.6-tuxcare.5 |
dompurifyTuxCare:npm From an advisory covering 10 CVEs |
3.0.5-tuxcare.0 up to 3.0.5-tuxcare.4, plus listed versions 3.0.53.0.5-tuxcare.13.0.5-tuxcare.23.0.5-tuxcare.3 |
3.0.5-tuxcare.4 |
dompurifyTuxCare:npm From an advisory covering 10 CVEs |
3.0.4-tuxcare.0 up to 3.0.4-tuxcare.4, plus listed versions 3.0.43.0.4-tuxcare.13.0.4-tuxcare.23.0.4-tuxcare.3 |
3.0.4-tuxcare.4 |
dompurifyTuxCare:npm |
2.3.3-tuxcare.0 up to 2.3.3-tuxcare.6, plus listed versions 2.3.32.3.3-tuxcare.12.3.3-tuxcare.22.3.3-tuxcare.32.3.3-tuxcare.42.3.3-tuxcare.5 |
2.3.3-tuxcare.6 |
node-dompurifyDebian:12 |
All versions, plus listed versions 2.4.1+dfsg+~2.4.0-12.4.1+dfsg+~2.4.0-22.4.1+dfsg+~2.4.0-2+deb12u13.0.9+dfsg+~3.0.5-13.1.6+dfsg+~3.0.5-1 Show 13 moreShow less3.1.7+dfsg+~3.0.5-13.1.7+dfsg+~3.0.5-23.2.5+dfsg-13.3.2+dfsg-13.3.3+dfsg-13.3.3+dfsg-23.4.1+dfsg-13.4.12+dfsg-13.4.13+dfsg-13.4.13+dfsg-23.4.16+dfsg-13.4.2+dfsg-13.4.5+dfsg-1 |
None known |
node-dompurifyDebian:13 |
All versions, plus listed versions 3.1.7+dfsg+~3.0.5-23.2.5+dfsg-13.3.2+dfsg-13.3.3+dfsg-13.3.3+dfsg-2 Show 7 moreShow less3.4.1+dfsg-13.4.12+dfsg-13.4.13+dfsg-13.4.13+dfsg-23.4.16+dfsg-13.4.2+dfsg-13.4.5+dfsg-1 |
None known |
node-dompurifyDebian:14 |
before 3.4.13+dfsg-1, plus listed versions 3.1.7+dfsg+~3.0.5-23.2.5+dfsg-13.3.2+dfsg-13.3.3+dfsg-13.3.3+dfsg-2 Show 4 moreShow less3.4.1+dfsg-13.4.12+dfsg-13.4.2+dfsg-13.4.5+dfsg-1 |
3.4.13+dfsg-1 |
grafana13.1Red Hat:hummingbird:1 From an advisory covering 4 CVEs |
before 0:13.1.3-0.9.hum1 | 0:13.1.3-0.9.hum1 |
grafana12.4Red Hat:hummingbird:1 |
before 0:12.4.10-0.7.hum1 | 0:12.4.10-0.7.hum1 |
grafana13.2Red Hat:hummingbird:1 |
before 0:13.2.1-0.6.hum1 | 0:13.2.1-0.6.hum1 |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el10ap | 0:1.6.8-1.el10ap |
receptorRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:2.6.17-3.el9ap | 0:2.6.17-3.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
python-sqlparseRed Hat:ansible_automation_platform_developer:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python3-sqlparseRed Hat:ansible_automation_platform_developer:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python-sqlparseRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python3-sqlparseRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python3.12-sqlparseRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
python3.12-sqlparseRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
automation-platform-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:2.6.14-1.el9ap | 0:2.6.14-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-serverRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
python3.12-gitpythonRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:3.1.60-1.el9ap | 0:3.1.60-1.el9ap |
grafana13.2Red Hat:hummingbird:1 From an advisory covering 4 CVEs |
before 0:13.2.1-0.7.hum1 | 0:13.2.1-0.7.hum1 |
node-dompurifyUbuntu:22.04:LTS |
All versions, plus listed versions 2.3.0+dfsg-22.3.3+dfsg-1 |
None known |
node-dompurifyUbuntu:24.04:LTS |
All versions, plus listed versions 2.4.1+dfsg+~2.4.0-13.0.9+dfsg+~3.0.5-1 |
None known |
node-dompurifyUbuntu:26.10 |
All versions, plus listed versions 3.3.3+dfsg-13.4.2+dfsg-13.4.5+dfsg-13.4.12+dfsg-13.4.13+dfsg-13.4.13+dfsg-2 |
None known |
node-dompurifyUbuntu:26.04:LTS |
All versions, plus listed versions 3.1.7+dfsg+~3.0.5-23.3.3+dfsg-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-75838 is a medium vulnerability (CVSS 5.1) in Cure53 Dompurify, published August 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in dompurify 3.1.6-tuxcare.8.
References
github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7
vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook
nvd.nist.gov/vuln/detail/CVE-2026-75838
security-tracker.debian.org/tracker/CVE-2026-75838
Show 194 moreShow less
access.redhat.com/errata/RHSA-2026:67573
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67573.json
bugzilla.redhat.com/show_bug.cgi?id=2491346
cve.org/CVERecord?id=CVE-2026-9029
grafana.com/security/security-advisories/cve-2026-9029
docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates
go.dev/cl/814980
groups.google.com/g/golang-announce/c/94pEornpRlI
pkg.go.dev/vuln/GO-2026-5972
cna.openjsf.org/security-advisories.html
ubuntu.com/security/CVE-2026-75838
Left out here: 170 references. The JSON record has them.