{"id":"CVE-2026-116803","aliases":["CLSA-2026-1793097032","CLSA-2026-1793097070","CLSA-2026-1793097137","CLSA-2026-1793097251","CLSA-2026-1793097362","CLSA-2026-1793097542","CLSA-2026-1793097697","CLSA-2026-1793100794","CLSA-2026-1793100979","CLSA-2026-1793101079","CLSA-2026-1793101206","CLSA-2026-1793101291","CLSA-2026-1793101437","CLSA-2026-1793101539","CLSA-2026-1793101597","CLSA-2026-1793101643","CLSA-2026-1793101664","CLSA-2026-1793101714","CLSA-2026-1793101764","CLSA-2026-1793101815","CLSA-2026-1793101830","CLSA-2026-1793101846","CLSA-2026-1793101871","CLSA-2026-1793101938","CLSA-2026-1793102041","CLSA-2026-1793102164","CLSA-2026-1793102424","CLSA-2026-1793109624","CLSA-2026-1793109867","CLSA-2026-1793110512","CLSA-2026-1793112297","CLSA-2026-1793120016","CLSA-2026-1793120032","CLSA-2026-1793120128","CLSA-2026-1793120140","CLSA-2026-1793126384","CLSA-2026-1793126491","CLSA-2026-1793127475","CLSA-2026-1793127593","CLSA-2026-1793129489","CLSA-2026-1793129671","DEBIAN-CVE-2026-116803","EUVD-2026-110511","GHSA-77h4-4vqj-j7vc","UBUNTU-CVE-2026-116803"],"status":"published","title":"DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00164,"percentile":0.05707,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-10-26T23:05:35Z","modified":"2026-11-02T22:00:06Z","fixes":[{"ecosystem":"TuxCare:npm","package":"dompurify","fixed_in":["2.4.0-tuxcare.10","3.3.3-tuxcare.5","3.0.9-tuxcare.5","3.0.3-tuxcare.9","3.0.6-tuxcare.6","2.3.0-tuxcare.10","3.1.3-tuxcare.5","3.0.11-tuxcare.5","3.1.1-tuxcare.5","3.2.6-tuxcare.5","3.4.0-tuxcare.2","3.2.3-tuxcare.7","3.1.4-tuxcare.5","3.1.6-tuxcare.11","2.5.9-tuxcare.13","2.4.7-tuxcare.10","2.4.3-tuxcare.13","2.0.8-tuxcare.7","3.1.0-tuxcare.5","3.1.2-tuxcare.5","2.5.8-tuxcare.11","3.0.8-tuxcare.5","3.0.2-tuxcare.5","3.0.1-tuxcare.5","2.3.10-tuxcare.5","2.3.3-tuxcare.5","3.2.7-tuxcare.7","3.4.16-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-dompurify","fixed_in":["3.4.17+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0-tuxcare.0"},{"fixed":"2.4.0-tuxcare.10"}]}],"versions":["2.4.0","2.4.0-tuxcare.1","2.4.0-tuxcare.2","2.4.0-tuxcare.3","2.4.0-tuxcare.4","2.4.0-tuxcare.5","2.4.0-tuxcare.6","2.4.0-tuxcare.7","2.4.0-tuxcare.8","2.4.0-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.3-tuxcare.0"},{"fixed":"3.3.3-tuxcare.5"}]}],"versions":["3.3.3","3.3.3-tuxcare.1","3.3.3-tuxcare.2","3.3.3-tuxcare.3","3.3.3-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.9-tuxcare.0"},{"fixed":"3.0.9-tuxcare.5"}]}],"versions":["3.0.9","3.0.9-tuxcare.1","3.0.9-tuxcare.2","3.0.9-tuxcare.3","3.0.9-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.3-tuxcare.0"},{"fixed":"3.0.3-tuxcare.9"}]}],"versions":["3.0.3","3.0.3-tuxcare.1","3.0.3-tuxcare.2","3.0.3-tuxcare.3","3.0.3-tuxcare.4","3.0.3-tuxcare.5","3.0.3-tuxcare.6","3.0.3-tuxcare.7","3.0.3-tuxcare.8"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.6-tuxcare.0"},{"fixed":"3.0.6-tuxcare.6"}]}],"versions":["3.0.6","3.0.6-tuxcare.1","3.0.6-tuxcare.2","3.0.6-tuxcare.3","3.0.6-tuxcare.4","3.0.6-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0-tuxcare.0"},{"fixed":"2.3.0-tuxcare.10"}]}],"versions":["2.3.0","2.3.0-tuxcare.1","2.3.0-tuxcare.2","2.3.0-tuxcare.3","2.3.0-tuxcare.4","2.3.0-tuxcare.5","2.3.0-tuxcare.6","2.3.0-tuxcare.7","2.3.0-tuxcare.8","2.3.0-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.3-tuxcare.0"},{"fixed":"3.1.3-tuxcare.5"}]}],"versions":["3.1.3","3.1.3-tuxcare.1","3.1.3-tuxcare.2","3.1.3-tuxcare.3","3.1.3-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5-tuxcare.0"},{"fixed":"3.4.5-tuxcare.5"}]}],"versions":["3.4.5","3.4.5-tuxcare.1","3.4.5-tuxcare.2","3.4.5-tuxcare.3","3.4.5-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.8-tuxcare.0"},{"fixed":"3.4.8-tuxcare.7"}]}],"versions":["3.4.8","3.4.8-tuxcare.1","3.4.8-tuxcare.2","3.4.8-tuxcare.3","3.4.8-tuxcare.4","3.4.8-tuxcare.5","3.4.8-tuxcare.6"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.13-tuxcare.0"},{"fixed":"3.4.13-tuxcare.3"}]}],"versions":["3.4.13","3.4.13-tuxcare.1","3.4.13-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.11-tuxcare.0"},{"fixed":"3.4.11-tuxcare.5"}]}],"versions":["3.4.11","3.4.11-tuxcare.1","3.4.11-tuxcare.2","3.4.11-tuxcare.3","3.4.11-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.6-tuxcare.0"},{"fixed":"3.4.6-tuxcare.5"}]}],"versions":["3.4.6","3.4.6-tuxcare.1","3.4.6-tuxcare.2","3.4.6-tuxcare.3","3.4.6-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.7-tuxcare.0"},{"fixed":"3.4.7-tuxcare.5"}]}],"versions":["3.4.7","3.4.7-tuxcare.1","3.4.7-tuxcare.2","3.4.7-tuxcare.3","3.4.7-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.14-tuxcare.0"},{"fixed":"3.4.14-tuxcare.4"}]}],"versions":["3.4.14","3.4.14-tuxcare.1","3.4.14-tuxcare.2","3.4.14-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.9-tuxcare.0"},{"fixed":"3.4.9-tuxcare.5"}]}],"versions":["3.4.9","3.4.9-tuxcare.1","3.4.9-tuxcare.2","3.4.9-tuxcare.3","3.4.9-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.11-tuxcare.0"},{"fixed":"3.0.11-tuxcare.5"}]}],"versions":["3.0.11","3.0.11-tuxcare.1","3.0.11-tuxcare.2","3.0.11-tuxcare.3","3.0.11-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-tuxcare.0"},{"fixed":"3.1.1-tuxcare.5"}]}],"versions":["3.1.1","3.1.1-tuxcare.1","3.1.1-tuxcare.2","3.1.1-tuxcare.3","3.1.1-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.6-tuxcare.0"},{"fixed":"3.2.6-tuxcare.5"}]}],"versions":["3.2.6","3.2.6-tuxcare.1","3.2.6-tuxcare.2","3.2.6-tuxcare.3","3.2.6-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0-tuxcare.0"},{"fixed":"3.4.0-tuxcare.2"}]}],"versions":["3.4.0","3.4.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.3-tuxcare.0"},{"fixed":"3.2.3-tuxcare.7"}]}],"versions":["3.2.3","3.2.3-tuxcare.1","3.2.3-tuxcare.2","3.2.3-tuxcare.3","3.2.3-tuxcare.4","3.2.3-tuxcare.5","3.2.3-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.4-tuxcare.0"},{"fixed":"3.1.4-tuxcare.5"}]}],"versions":["3.1.4","3.1.4-tuxcare.1","3.1.4-tuxcare.2","3.1.4-tuxcare.3","3.1.4-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.6-tuxcare.0"},{"fixed":"3.1.6-tuxcare.11"}]}],"versions":["3.1.6","3.1.6-tuxcare.1","3.1.6-tuxcare.10","3.1.6-tuxcare.2","3.1.6-tuxcare.3","3.1.6-tuxcare.4","3.1.6-tuxcare.5","3.1.6-tuxcare.6","3.1.6-tuxcare.7","3.1.6-tuxcare.8","3.1.6-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.5-tuxcare.0"},{"fixed":"3.0.5-tuxcare.4"}]}],"versions":["3.0.5","3.0.5-tuxcare.1","3.0.5-tuxcare.2","3.0.5-tuxcare.3"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.10-tuxcare.0"},{"fixed":"3.4.10-tuxcare.5"}]}],"versions":["3.4.10","3.4.10-tuxcare.1","3.4.10-tuxcare.2","3.4.10-tuxcare.3","3.4.10-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.4-tuxcare.0"},{"fixed":"3.0.4-tuxcare.4"}]}],"versions":["3.0.4","3.0.4-tuxcare.1","3.0.4-tuxcare.2","3.0.4-tuxcare.3"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.12-tuxcare.0"},{"fixed":"3.4.12-tuxcare.3"}]}],"versions":["3.4.12","3.4.12-tuxcare.1","3.4.12-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.15-tuxcare.0"},{"fixed":"3.4.15-tuxcare.3"}]}],"versions":["3.4.15","3.4.15-tuxcare.1","3.4.15-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.9-tuxcare.0"},{"fixed":"2.5.9-tuxcare.13"}]}],"versions":["2.5.9","2.5.9-tuxcare.1","2.5.9-tuxcare.10","2.5.9-tuxcare.11","2.5.9-tuxcare.12","2.5.9-tuxcare.2","2.5.9-tuxcare.3","2.5.9-tuxcare.4","2.5.9-tuxcare.5","2.5.9-tuxcare.6","2.5.9-tuxcare.7","2.5.9-tuxcare.8","2.5.9-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.7-tuxcare.0"},{"fixed":"2.4.7-tuxcare.10"}]}],"versions":["2.4.7","2.4.7-tuxcare.1","2.4.7-tuxcare.2","2.4.7-tuxcare.3","2.4.7-tuxcare.4","2.4.7-tuxcare.5","2.4.7-tuxcare.6","2.4.7-tuxcare.7","2.4.7-tuxcare.8","2.4.7-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.3-tuxcare.0"},{"fixed":"2.4.3-tuxcare.13"}]}],"versions":["2.4.3","2.4.3-tuxcare.1","2.4.3-tuxcare.10","2.4.3-tuxcare.11","2.4.3-tuxcare.12","2.4.3-tuxcare.2","2.4.3-tuxcare.3","2.4.3-tuxcare.4","2.4.3-tuxcare.5","2.4.3-tuxcare.6","2.4.3-tuxcare.7","2.4.3-tuxcare.8","2.4.3-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.8-tuxcare.0"},{"fixed":"2.0.8-tuxcare.7"}]}],"versions":["2.0.8","2.0.8-tuxcare.1","2.0.8-tuxcare.2","2.0.8-tuxcare.3","2.0.8-tuxcare.4","2.0.8-tuxcare.5","2.0.8-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0-tuxcare.0"},{"fixed":"3.1.0-tuxcare.5"}]}],"versions":["3.1.0","3.1.0-tuxcare.1","3.1.0-tuxcare.2","3.1.0-tuxcare.3","3.1.0-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2-tuxcare.0"},{"fixed":"3.1.2-tuxcare.5"}]}],"versions":["3.1.2","3.1.2-tuxcare.1","3.1.2-tuxcare.2","3.1.2-tuxcare.3","3.1.2-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.8-tuxcare.0"},{"fixed":"2.5.8-tuxcare.11"}]}],"versions":["2.5.8","2.5.8-tuxcare.1","2.5.8-tuxcare.10","2.5.8-tuxcare.2","2.5.8-tuxcare.3","2.5.8-tuxcare.4","2.5.8-tuxcare.5","2.5.8-tuxcare.6","2.5.8-tuxcare.7","2.5.8-tuxcare.8","2.5.8-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.8-tuxcare.0"},{"fixed":"3.0.8-tuxcare.5"}]}],"versions":["3.0.8","3.0.8-tuxcare.1","3.0.8-tuxcare.2","3.0.8-tuxcare.3","3.0.8-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.2-tuxcare.0"},{"fixed":"3.0.2-tuxcare.5"}]}],"versions":["3.0.2","3.0.2-tuxcare.1","3.0.2-tuxcare.2","3.0.2-tuxcare.3","3.0.2-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.1-tuxcare.0"},{"fixed":"3.0.1-tuxcare.5"}]}],"versions":["3.0.1","3.0.1-tuxcare.1","3.0.1-tuxcare.2","3.0.1-tuxcare.3","3.0.1-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.10-tuxcare.0"},{"fixed":"2.3.10-tuxcare.5"}]}],"versions":["2.3.10","2.3.10-tuxcare.1","2.3.10-tuxcare.2","2.3.10-tuxcare.3","2.3.10-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.3-tuxcare.0"},{"fixed":"2.3.3-tuxcare.5"}]}],"versions":["2.3.3","2.3.3-tuxcare.1","2.3.3-tuxcare.2","2.3.3-tuxcare.3","2.3.3-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.7-tuxcare.0"},{"fixed":"3.2.7-tuxcare.7"}]}],"versions":["3.2.7","3.2.7-tuxcare.1","3.2.7-tuxcare.2","3.2.7-tuxcare.3","3.2.7-tuxcare.4","3.2.7-tuxcare.5","3.2.7-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.16-tuxcare.0"},{"fixed":"3.4.16-tuxcare.2"}]}],"versions":["3.4.16","3.4.16-tuxcare.1"]},{"source":"osv","ecosystem":"Debian:12","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1+dfsg+~2.4.0-1","2.4.1+dfsg+~2.4.0-2","2.4.1+dfsg+~2.4.0-2+deb12u1","3.0.9+dfsg+~3.0.5-1","3.1.6+dfsg+~3.0.5-1","3.1.7+dfsg+~3.0.5-1","3.1.7+dfsg+~3.0.5-2","3.2.5+dfsg-1","3.3.2+dfsg-1","3.3.3+dfsg-1","3.3.3+dfsg-2","3.4.1+dfsg-1","3.4.12+dfsg-1","3.4.13+dfsg-1","3.4.13+dfsg-2","3.4.16+dfsg-1","3.4.17+dfsg-1","3.4.2+dfsg-1","3.4.5+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.7+dfsg+~3.0.5-2","3.2.5+dfsg-1","3.3.2+dfsg-1","3.3.3+dfsg-1","3.3.3+dfsg-2","3.4.1+dfsg-1","3.4.12+dfsg-1","3.4.13+dfsg-1","3.4.13+dfsg-2","3.4.16+dfsg-1","3.4.17+dfsg-1","3.4.2+dfsg-1","3.4.5+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.17+dfsg-1"}]}],"versions":["3.1.7+dfsg+~3.0.5-2","3.2.5+dfsg-1","3.3.2+dfsg-1","3.3.3+dfsg-1","3.3.3+dfsg-2","3.4.1+dfsg-1","3.4.12+dfsg-1","3.4.13+dfsg-1","3.4.13+dfsg-2","3.4.16+dfsg-1","3.4.2+dfsg-1","3.4.5+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0+dfsg-2","2.3.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1+dfsg+~2.4.0-1","3.0.9+dfsg+~3.0.5-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.3+dfsg-1","3.4.2+dfsg-1","3.4.5+dfsg-1","3.4.12+dfsg-1","3.4.13+dfsg-1","3.4.13+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.7+dfsg+~3.0.5-2","3.3.3+dfsg-1"]}],"products":[{"vendor":"cure53","product":"dompurify"}],"references":[{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-mrv2-3pqr-j5jr","tags":["vendor-advisory","exploit","advisory","report"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-3.4.17-dom-xss-via-in-place-hook-detached-subtrees","tags":["third-party-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116803","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-77h4-4vqj-j7vc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116803.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-116803","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-116803","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116803","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-116803","title":"DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.","status":"published","published":"2026-10-26T23:05:35.135Z","modified":"2026-10-31T02:06:02.382Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:03.827373Z"}],"euvd":[{"id":"EUVD-2026-110511","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.","status":"published","published":"2026-10-26T23:05:35Z","modified":"2026-10-31T02:06:02Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:59:01.198534Z"}],"ghsa":[{"id":"GHSA-77h4-4vqj-j7vc","title":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to...","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.","status":"published","published":"2026-10-27T00:32:50Z","modified":"2026-10-27T00:32:54Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:14:27.349207Z"}],"nvd":[{"id":"CVE-2026-116803","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.","status":"published","published":"2026-10-27T00:17:11.913Z","modified":"2026-10-31T03:17:17.177Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:13:03.746397Z"}],"osv":[{"id":"CVE-2026-116803","title":"DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.","status":"published","published":"2026-10-26T23:05:35.135Z","modified":"2026-11-01T02:30:34.453375265Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:56.675758Z"},{"id":"DEBIAN-CVE-2026-116803","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.","status":"published","published":"2026-10-27T00:17:11.913Z","modified":"2026-11-02T22:00:06.544503686Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-03T00:03:07.015763Z"},{"id":"UBUNTU-CVE-2026-116803","description":"DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.","status":"published","published":"2026-10-27T00:17:00Z","modified":"2026-10-28T20:17:46.253348101Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:00.081948Z"},{"id":"CLSA-2026-1793097032","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.4.0-tuxcare.10.","status":"published","published":"2026-10-27T10:30:32Z","modified":"2026-10-27T13:30:13.66926801Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793097070","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.3.3-tuxcare.5.","status":"published","published":"2026-10-27T10:31:10Z","modified":"2026-10-27T13:30:06.66323658Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793097137","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.0.9-tuxcare.5.","status":"published","published":"2026-10-27T10:32:17Z","modified":"2026-10-27T13:30:13.270372508Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793097251","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.0.3-tuxcare.9.","status":"published","published":"2026-10-27T10:34:11Z","modified":"2026-10-27T13:30:13.030829887Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793097362","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.0.6-tuxcare.6.","status":"published","published":"2026-10-27T10:36:02Z","modified":"2026-10-27T13:30:16.631154241Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793097542","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.3.0-tuxcare.10.","status":"published","published":"2026-10-27T10:39:02Z","modified":"2026-10-27T13:30:13.034395416Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793097697","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.1.3-tuxcare.5.","status":"published","published":"2026-10-27T10:41:37Z","modified":"2026-10-27T13:30:16.646700659Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793100794","title":"TuxCare security update for dompurify (3 CVEs)","description":"TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.5-tuxcare.5.","status":"published","published":"2026-10-27T11:33:14Z","modified":"2026-10-27T13:30:09.760475844Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793100979","title":"TuxCare security update for dompurify (3 CVEs)","description":"TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.8-tuxcare.7.","status":"published","published":"2026-10-27T11:36:19Z","modified":"2026-10-27T13:30:08.308226646Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793101079","title":"TuxCare security update for dompurify (3 CVEs)","description":"TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.13-tuxcare.3.","status":"published","published":"2026-10-27T11:37:59Z","modified":"2026-10-27T13:30:10.473558019Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793101206","title":"TuxCare security update for dompurify (3 CVEs)","description":"TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.11-tuxcare.5.","status":"published","published":"2026-10-27T11:40:06Z","modified":"2026-10-27T13:30:09.756569656Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793101291","title":"TuxCare security update for dompurify (3 CVEs)","description":"TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.6-tuxcare.5.","status":"published","published":"2026-10-27T11:41:31Z","modified":"2026-10-27T13:30:08.315711744Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793101437","title":"TuxCare security update for dompurify (3 CVEs)","description":"TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.7-tuxcare.5.","status":"published","published":"2026-10-27T11:43:57Z","modified":"2026-10-27T13:30:08.310514508Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793101539","title":"TuxCare security update for dompurify (3 CVEs)","description":"TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.14-tuxcare.4.","status":"published","published":"2026-10-27T11:45:39Z","modified":"2026-10-27T13:30:13.028155973Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793101597","title":"TuxCare security update for dompurify (3 CVEs)","description":"TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.9-tuxcare.5.","status":"published","published":"2026-10-27T11:46:37Z","modified":"2026-10-27T13:30:17.548231676Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793101643","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.0.11-tuxcare.5.","status":"published","published":"2026-10-27T11:47:23Z","modified":"2026-10-27T13:30:18.443828932Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793101664","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.1.1-tuxcare.5.","status":"published","published":"2026-10-27T11:47:44Z","modified":"2026-10-27T13:30:18.448756785Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793101714","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.2.6-tuxcare.5.","status":"published","published":"2026-10-27T11:48:34Z","modified":"2026-10-27T13:30:18.444938143Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793101764","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.4.0-tuxcare.2.","status":"published","published":"2026-10-27T11:49:24Z","modified":"2026-10-27T13:30:14.829341439Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793101815","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.2.3-tuxcare.7.","status":"published","published":"2026-10-27T11:50:15Z","modified":"2026-10-27T13:30:13.976490153Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793101830","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.1.4-tuxcare.5.","status":"published","published":"2026-10-27T11:50:30Z","modified":"2026-10-27T13:30:13.986804682Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793101846","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.1.6-tuxcare.11.","status":"published","published":"2026-10-27T11:50:46Z","modified":"2026-10-27T13:30:13.973606056Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793101871","title":"TuxCare security update for dompurify (11 CVEs)","description":"TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.0.5-tuxcare.4.","status":"published","published":"2026-10-27T11:51:11Z","modified":"2026-10-27T13:30:17.537780888Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793101938","title":"TuxCare security update for dompurify (3 CVEs)","description":"TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.10-tuxcare.5.","status":"published","published":"2026-10-27T11:52:18Z","modified":"2026-10-27T13:30:17.544935458Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793102041","title":"TuxCare security update for dompurify (11 CVEs)","description":"TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.0.4-tuxcare.4.","status":"published","published":"2026-10-27T11:54:01Z","modified":"2026-10-27T13:30:18.443508774Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793102164","title":"TuxCare security update for dompurify (4 CVEs)","description":"TuxCare rebuilt dompurify to address 4 CVEs. Fixed in 3.4.12-tuxcare.3.","status":"published","published":"2026-10-27T11:56:04Z","modified":"2026-10-27T13:30:18.441793863Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793102424","title":"TuxCare security update for dompurify (3 CVEs)","description":"TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.15-tuxcare.3.","status":"published","published":"2026-10-27T12:00:24Z","modified":"2026-10-27T13:30:11.874311351Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793109624","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.5.9-tuxcare.13.","status":"published","published":"2026-10-27T14:00:24Z","modified":"2026-10-27T19:30:04.471225396Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793109867","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.4.7-tuxcare.10.","status":"published","published":"2026-10-27T14:04:27Z","modified":"2026-10-27T19:30:04.621586023Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793110512","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.4.3-tuxcare.13.","status":"published","published":"2026-10-27T14:15:12Z","modified":"2026-10-27T19:30:03.232082891Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793112297","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.0.8-tuxcare.7.","status":"published","published":"2026-10-27T14:44:57Z","modified":"2026-10-27T19:30:04.621517916Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793120016","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.1.0-tuxcare.5.","status":"published","published":"2026-10-27T16:53:36Z","modified":"2026-10-27T19:30:07.246260107Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793120032","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.1.2-tuxcare.5.","status":"published","published":"2026-10-27T16:53:52Z","modified":"2026-10-27T19:30:06.230588136Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793120128","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.5.8-tuxcare.11.","status":"published","published":"2026-10-27T16:55:28Z","modified":"2026-10-27T19:30:06.634997118Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793120140","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.0.8-tuxcare.5.","status":"published","published":"2026-10-27T16:55:40Z","modified":"2026-10-27T19:30:07.251247149Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793126384","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.0.2-tuxcare.5.","status":"published","published":"2026-10-27T18:39:44Z","modified":"2026-10-28T01:45:48.977135941Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793126491","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.0.1-tuxcare.5.","status":"published","published":"2026-10-27T18:41:31Z","modified":"2026-10-28T01:45:48.265232983Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793127475","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.3.10-tuxcare.5.","status":"published","published":"2026-10-27T18:57:55Z","modified":"2026-10-28T01:45:48.264368321Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793127593","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.3.3-tuxcare.5.","status":"published","published":"2026-10-27T18:59:53Z","modified":"2026-10-28T01:45:54.134392654Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793129489","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.2.7-tuxcare.7.","status":"published","published":"2026-10-27T19:31:29Z","modified":"2026-10-28T01:45:49.068416856Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793129671","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.4.16-tuxcare.2.","status":"published","published":"2026-10-27T19:34:31Z","modified":"2026-10-28T01:45:54.129723731Z","updated_at":"2026-11-02T15:43:55.34846Z"}]}}