< Back

CVE-2026-109345

Updated on 12 Oct 2026

Severity

6.1 Medium severity

Details

CVSS score
6.1
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the returned node.

Details

Affected product:
dompurify , gateway , graphql-hive-gateway , graphql-hive/console , isomorphic-dompurify , monaco-editor , monaco-react , octanejs-monaco-editor , rspress , runtime-cli , sanity-cli , sanity-cli-build , strapi-content-manager , strapi-content-releases , strapi-i18n , strapi-plugin-cloud , strapi-plugin-color-picker , strapi-plugin-documentation , strapi-plugin-graphql , strapi-plugin-sentry , strapi-plugin-users-permissions , strapi-review-workflows , strapi-strapi
Affected packages:
@graphql-hive/gateway @ 2.15.0 (+288 more)

Fixes