CVE-2026-109344
Description
A flaw was found in DOMPurify. When performing in-place sanitization directly on active webpage elements, the library fails to neutralize content detached by post-processing hooks. A remote attacker can exploit this issue by supplying crafted markup containing malicious event handlers inside elements removed by these hooks. Successful exploitation allows the malicious scripts to execute within the victim browser session, leading to Cross-Site Scripting (XSS).
Statement
A Moderate cross-site scripting (XSS) vulnerability was found in DOMPurify, an npm HTML-sanitization library that within Red Hat is bundled only as a dependency in components of Red Hat Hardened Images (Hummingbird). When DOMPurify sanitizes a live DOM subtree in IN_PLACE mode, elements detached by afterSanitizeElements or afterSanitizeAttributes hooks are not neutralized, because the library applies its hook-detach neutralization only at the beforeSanitizeElements and uponSanitizeElement hook sites. A remote attacker who can supply crafted markup to an application that combines IN_PLACE mode with a node-removing afterSanitize hook can hide event handlers (on* attributes) inside a wrapper element that the hook removes; those handlers remain armed on the caller's live DOM after sanitize() returns and execute attacker-controlled script in the victim's browser in the page origin. Exploitation requires user interaction, and the exact confidentiality and integrity impact depends on the hosting application's session. Red Hat rates this flaw Moderate (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), matching the severity in the CVE record; the upstream DOMPurify GitHub advisory labels the issue as low severity. Under the Hummingbird module's process, trackers are filed for bundled components regardless of impact; the delegated Hummingbird review resolved the affected components as not affected and closed the trackers as Not a Bug, recording that the vulnerable component or vulnerable code is not present in the shipped builds. No shipped Red Hat product is currently known to be affected, and no Red Hat fix is being pursued for this flaw.
Mitigation
Applications using DOMPurify's IN_PLACE mode can mitigate this issue without changing the library by not removing nodes inside afterSanitizeElements or afterSanitizeAttributes hooks; node removals should instead be performed in beforeSanitizeElements or uponSanitizeElement hooks, where detached subtrees are neutralized. Alternatively, avoid using IN_PLACE mode for attacker-influenced content and sanitize into a detached DOM (the default behavior) instead of the live tree. Applications bundling an affected DOMPurify release can update to the upstream patched release (3.4.16 or later). The Red Hat Hardened Images (Hummingbird) components that bundle DOMPurify have been assessed as not affected, so no Red Hat product update is currently required for this issue.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.1 | N/A | 6.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Changed | N/A | Changed |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Understanding the Weakness (CWE)
Access Control,Confidentiality
Technical Impact: Bypass Protection Mechanism; Read Application Data
The most common attack performed with cross-site scripting involves the disclosure of private information stored in user cookies, such as session information. Typically, a malicious user will craft a client-side script, which -- when parsed by a web browser -- performs some activity on behalf of the victim to an attacker-controlled system (such as sending all site cookies to a given E-mail address). This could be especially dangerous to the site if the victim has administrator privileges to manage that site. This script will be loaded and run by each user visiting the web site. Since the site requesting to run the script has access to the cookies in question, the malicious script does also.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
In some circumstances it may be possible to run arbitrary code on a victim's computer when cross-site scripting is combined with other flaws, for example, "drive-by hacking."
Confidentiality,Integrity,Availability,Access Control
Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Read Application Data
The consequence of an XSS attack is the same regardless of whether it is stored or reflected. The difference is in how the payload arrives at the server. XSS can cause a variety of problems for the end user that range in severity from an annoyance to complete account compromise. Some cross-site scripting vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on the end user systems for a variety of nefarious purposes. Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs, redirecting the user to some other page or site, running "Active X" controls (under Microsoft Internet Explorer) from sites that a user perceives as trustworthy, and modifying presentation of content.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
