CVE-2026-109345 cure53 CVE debrief

Who should care

Defenders responsible for maintaining and securing applications that use the DOMPurify library should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and sanitizing user-supplied input, implementing additional security measures to detect and prevent exploitation, and verifying and updating DOMPurify versions to prevent exploitation. Operators, platform administrators, vulnerability management teams, and security teams

Why it matters

This vulnerability allows attackers to bypass sanitization in DOMPurify before version 3.4.16, potentially leading to cross-site scripting attacks. Defenders should prioritize updating DOMPurify and implementing additional security measures to detect and prevent exploitation.

• Cross-site scripting attacks can be launched against vulnerable applications
• An attacker can execute script by supplying a malicious style element
• Defenders must verify and update DOMPurify versions to prevent exploitation

Technical summary

The vulnerability exists in the DOMPurify library before version 3.4.16. When IN_PLACE mode is used, a force-removed style element's text content can still carry markup, allowing attackers to bypass sanitization and execute script. This can be done by supplying a style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the returned node. The vulnerability can be mitigated by updating DOMPurify to version 3.4.16 or later and implementing additional security measures.

Defensive priority

Defenders should prioritize updating DOMPurify to version 3.4.16 or later to mitigate this vulnerability.

Recommended defensive actions

• Update DOMPurify to version 3.4.16 or later
• Review and sanitize user-supplied input to prevent cross-site scripting attacks
• Implement additional security measures to detect and prevent exploitation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by the IN_PLACE mode returning a force-removed style element whose text content still carries markup. An attacker can supply a style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the returned node.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.