Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vuln - CVE-2026-109344 - Vulnerability Database
DOMPurify

DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vuln - CVE-2026-109344

Medium
Reference: CVE-2026-109344
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-109344
Title: DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vuln
Overview:

DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on handlers inside a wrapper removed by such hooks leaving handlers armed on the live DOM to execute script in the victim origin.