CVE-2026-116803

About vulnerability

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.

Affected product:

CopilotKit/CopilotKit , Next.js , copilotkit-react-native , copilotkit-react-textarea , copilotkit-react-ui , copilotkit-vue , create-sanity , crystal , docs , docusaurus-theme-mermaid , dompurify , fumadocs-sanity , gateway , gatsby , graphiql , graphiql-plugin-code-exporter , graphiql-plugin-collections , graphiql-plugin-doc-explorer , graphiql-plugin-history , graphiql-plugin-query-builder , graphiql-react , graphql-hive-gateway , graphql-hive/console , html2pdf.js , isomorphic-dompurify , jspdf , jspdf-autotable , ledger-live , lynx-js-config-rsbuild-plugin , lynx-js-css-extract-webpack-plugin , lynx-js-genui , lynx-js-luna-stage , lynx-js-luna-studio , lynx-js-lynx-bundle-rslib-config , lynx-js-react-alias-rsbuild-plugin , lynx-js-react-refresh-webpack-plugin , lynx-js-react-rsbuild-plugin , lynx-js-react-webpack-plugin , lynx-js-rsbuild-plugin , lynx-js-rspeedy , lynx-js-template-webpack-plugin , lynx-js-vanilla-rsbuild-plugin , lynx-js-web-core , lynx-js-web-elements-compat , lynx-stack , mermaid , modern-js-main-doc , monaco-editor , monaco-graphql , monaco-react , monorepo , netlify-cms , netlify-cms-app , netlify-cms-widget-markdown , nuxt-devtools-ui-kit , octanejs-monaco-editor , octanejs-streamdown , posthog-browser-common , posthog-js , rails-actiontext , redoc , redocly-cli , rspress , runtime-cli , sanity , sanity-blueprints , sanity-cli , sanity-cli-build , sanity-plugin-mux-input , sanity-preview-url-secret , sanity-vercel-protection-bypass , sanity-vision , strapi-content-manager , strapi-content-releases , strapi-i18n , strapi-plugin-cloud , strapi-plugin-color-picker , strapi-plugin-documentation , strapi-plugin-graphql , strapi-plugin-sentry , strapi-plugin-users-permissions , strapi-review-workflows , strapi-strapi , streamdown , streamdown-mermaid , streamdown-vue , svg2pdf.js , swagger-ui , trix , vaadin-avatar , vaadin-avatar-group , vaadin-field-highlighter , vaadin-markdown , vaadin-message-list , vaadin-rich-text-editor , vaadin-tooltip , verdaccio , verdaccio-ui-components , yummies

Affected packages:

dompurify @ 2.3.0 (+1100 more)