Read the docs
TI-2026-53084 Aliases CVE-2026-75838GHSA-748c-f84h-hp2v

DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

Priority MEDIUM 56CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Partial Red Hat: 16 fixed, 23 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-79.

Summary

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00394 33rd percentileScored 2026-11-07
Fix Partial DOMPurify (cure53): 3.4.13Red Hat: 21 advisoriesRed Hat: 16 fixed, 23 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cure53DOMPurifybefore 3.4.133.4.13Patch availableCNA
  • DOMPurify Vendorcure53 Affected before 3.4.13 Fixed in 3.4.13 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*——cure53
  • cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:* Versions — — ·cure53

Remediation

  • Fix · CNA DOMPurify (cure53) Fixed in 3.4.13

Red Hat 21 advisories

  • RHSA-2026:95591 Released 2026-11-05 · Red Hat rating Important
    Cluster Observability Operator - 1.5
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 +16
  • RHSA-2026:95081 Released 2026-11-04 · Red Hat rating Important
    Cluster Observability Operator - 1.5
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 +16
  • RHSA-2026:94583 Released 2026-11-03 · Red Hat rating Critical
    Important: Red Hat OpenShift GitOps v1.21.7 security update
    • Red Hat OpenShift GitOps 1.21 registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9, registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9, registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9 +7
Show 18 more Red Hat advisories
  • RHSA-2026:94581 Released 2026-11-03 · Red Hat rating Critical
    Important: Red Hat OpenShift GitOps v1.20.10 security update
    • Red Hat OpenShift GitOps 1.20 registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9, registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9, registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9 +7
  • RHSA-2026:92510 Released 2026-10-29 · Red Hat rating Critical
    RHOAI 3.4.6 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:90321 Released 2026-10-26 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.31.0 Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:86891 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 3.5.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:71906 Released 2026-09-25 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.2-13.2.1-0.7.hum1@aarch64, grafana13.2-13.2.1-0.7.hum1@src, grafana13.2-13.2.1-0.7.hum1@x86_64
  • RHSA-2026:71113 Released 2026-09-23 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 python-sqlparse-0.6.0-1.el10ap, python3-sqlparse-0.6.0-1.el10ap, receptor-1.6.8-1.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.17-1.el9ap, automation-controller-cli-4.7.17-1.el9ap, automation-controller-server-4.7.17-1.el9ap +7
  • RHSA-2026:70994 Released 2026-09-23 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.2-13.2.1-0.6.hum1@aarch64, grafana13.2-13.2.1-0.6.hum1@src, grafana13.2-13.2.1-0.6.hum1@x86_64
  • RHSA-2026:70917 Released 2026-09-23 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana12.4-12.4.10-0.7.hum1@aarch64, grafana12.4-12.4.10-0.7.hum1@src, grafana12.4-12.4.10-0.7.hum1@x86_64
  • RHSA-2026:68695 Released 2026-09-17 · Red Hat rating Important
    Kiali 2.27.4 for Red Hat OpenShift Service Mesh 3.4
    • Red Hat OpenShift Service Mesh 3.4 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator
  • RHSA-2026:68690 Released 2026-09-17 · Red Hat rating Important
    Kiali 2.22.10 for Red Hat OpenShift Service Mesh 3.3
    • Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:67714 Released 2026-09-15 · Red Hat rating Important
    RHACS 4.11.4 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes 4.11 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9, registry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator, registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel9 +1
  • RHSA-2026:67711 Released 2026-09-15 · Red Hat rating Important
    RHACS 4.10.8 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8
  • RHSA-2026:67573 Released 2026-09-15 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.1-13.1.3-0.9.hum1@aarch64, grafana13.1-13.1.3-0.9.hum1@src, grafana13.1-13.1.3-0.9.hum1@x86_64
  • RHSA-2026:65155 Released 2026-09-08 · Red Hat rating Important
    Ansible plug-ins for Red Hat Developer Hub Product Release Update
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/automation-portal
  • RHSA-2026:65118 Released 2026-09-08 · Red Hat rating Important
    Ansible plug-ins for Red Hat Developer Hub Product Release Update
    • Red Hat Ansible Automation Platform 2.1 registry.redhat.io/ansible-automation-platform/automation-portal
  • RHSA-2026:62260 Released 2026-09-01 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.0 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Ansible Automation Orchestrator 2026AffectedNo fix yet
Migration Toolkit for VirtualizationAffectedNo fix yet
Node HealthCheck OperatorAffectedNo fix yet
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix planned: Out of support scope
Red Hat Ansible Automation Platform 2AffectedNo fix planned: Will not fix
Red Hat Build of Podman DesktopAffectedNo fix yet
Red Hat Ceph Storage 6AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Data Grid 8AffectedNo fix yet
Red Hat Developer Hub 1AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet: Fix deferred
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Cluster Observability Operator 1.5Fixed RHSA-2026:95081, RHSA-2026:95591
Red Hat Advanced Cluster Security for Kubernetes 4.11Fixed RHSA-2026:67714
Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10Fixed RHSA-2026:67711
Red Hat Ansible Automation Platform 2.1Fixed RHSA-2026:65118
Red Hat Ansible Automation Platform 2.2Fixed RHSA-2026:65155
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:71113
Red Hat Hardened ImagesFixed RHSA-2026:67573, RHSA-2026:70917, RHSA-2026:70994, RHSA-2026:71906
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734, RHSA-2026:92510
Red Hat OpenShift AI 3.5Fixed RHSA-2026:86891
Red Hat OpenShift Dev Spaces 3.30Fixed RHSA-2026:62260
Red Hat OpenShift Dev Spaces 3.31Fixed RHSA-2026:90321
Red Hat OpenShift GitOps 1.20Fixed RHSA-2026:94581
Red Hat OpenShift GitOps 1.21Fixed RHSA-2026:94583
Red Hat OpenShift Service Mesh 3.3Fixed RHSA-2026:68690
Red Hat OpenShift Service Mesh 3.4Fixed RHSA-2026:68695
Not affected: 31 products
  • Cluster Observability Operator 1.5
  • Cost Management On Premise
  • Cryostat 4
  • Multicluster Engine for Kubernetes
  • OpenShift Lightspeed
  • Red Hat 3scale API Management Platform 2
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 4
  • Red Hat Advanced Cluster Security for Kubernetes 4.11
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Build of Podman Desktop
  • Red Hat Developer Hub 1
  • Red Hat Enterprise Linux 10
  • Red Hat Hardened Images
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift AI 3.5
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces 3.30
  • Red Hat OpenShift Dev Spaces 3.31
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift GitOps 1.20
  • Red Hat OpenShift GitOps 1.21
  • Red Hat OpenShift Service Mesh 3.4
  • Red Hat OpenShift Virtualization 4
  • Red Hat build of Apache Camel for Spring Boot 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-75838
  2. 2026-10-03 Alias added: GHSA-748c-f84h-hp2v
  3. 2026-10-05 Affected versions changed · Red Hat
  4. 2026-10-09 Affected versions changed · Red Hat
  5. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  6. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  7. 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
  8. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  9. 2026-10-23 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.5 · Red Hat
  10. 2026-10-27 Affected versions changed · Red Hat
  11. 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat
  12. 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
  13. 2026-10-30 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
  14. 2026-10-30 Affected versions changed · Red Hat
  15. 2026-10-31 Fix available: Red Hat Advanced Cluster Security for Kubernetes 4.11 · Red Hat
  16. 2026-11-04 Fix available: RHSA-2026:94583 · Red Hat
  17. 2026-11-04 Fix available: RHSA-2026:94581 · Red Hat
  18. 2026-11-04 Fix available: Red Hat OpenShift GitOps 1.20, Red Hat OpenShift GitOps 1.21 · Red Hat
  19. 2026-11-04 Fix available: RHSA-2026:95081 · Red Hat
  20. 2026-11-04 Fix available: Cluster Observability Operator 1.5, Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat
  21. 2026-11-06 Affected versions changed · Red Hat
  22. 2026-11-06 Fix available: RHSA-2026:95591 · Red Hat

References

Advisory 1

  • TI-2026-34986 DOMPurify XSS via `selectedcontent` re-clone CVSS 3.1HIGH 8.2
  • TI-2025-30422 Path traversal in cure53 DOMPurify CVSS 3.1HIGH 7.5
  • TI-2026-29847 DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback CVSS 3.1MEDIUM 6.9
  • TI-2026-36811 DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content CVSS 4.0MEDIUM 6.3
  • TI-2026-36614 DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM CVSS 3.1MEDIUM 6.1
  • TI-2026-36613 DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks CVSS 3.1MEDIUM 6.1
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences