Vulnerabilities

Vulnerability · GHSA-mrv2-3pqr-j5jr

DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)

Published Oct 22, 2026 · catalog updated Oct 22, 2026 · DOMPurify IN_PLACE: hook that

Last checked Oct 23, 2026, 16 days ago.

Open the advisory

Exploitation likelihood is not on this record for GHSA-mrv2-3pqr-j5jr. A missing EPSS score is not a low risk. Compare DOMPurify IN_PLACE: hook that with the linked advisory before you change production.

Severity

High—

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Version ranges on file

Affected products

npm dompurify

### Summary The 3.4.16 fix for GHSA-p98j-92pf-mc4p only covers a hook that removes the node it was called for. If an hook removes a different node, like the current node's parent or a sibling that has not been visited yet, that subtree is never walked or neutralized. Event handlers in it stay on the elements, and an that was already loading fires after returns. The README says: "Nodes that a hook detaches from the tree ... are treated as removed. In IN_PLACE mode their subtree is neutralized inline, so an that was already loading when you built the live tree cannot fire after returns." That does not hold when the detached node is not the hook's own node. ### Tested versions - 3.4.16 (latest) and main at 18f8f0e - also 3.4.15, 3.4.12 and 2.5.8 jsdom for the matrix below, and Chromium (Playwright) for the event actually firing. ### Details line 2134 ( line 2009 in 3.4.16), : It only checks whether lost its parent. When a hook removes (or any ancestor), still has a parent, so nothing happens. The rest of the removed subtree is no longer reachable by the walker, and it is not in , so the post walk pass does not see it either. The same happens when a hook removes a later sibling. This applies to all five element and attribute hooks. ### PoC (jsdom) Output on 3.4.16: In mode the walker still reaches the second image and strips . In the other two modes the second image is detached with its handler still set. The same result is achieved with each of , , , and . ### PoC (browser) The same thing in a real page, served from 127.0.0.1 and opened in Chromium: Result on 3.4.16: The returned tree is clean in both cases, but the handler on the detached image runs in the page for . ### Impact An app that uses with a hook that removes a wrapper or a nearby element (for example "drop the whole if its image is not allowed") gets DOM XSS from attacker markup after returns. It needs that kind of hook, so it falls under "input plus an application choice" in SECURITY.md, but it breaks the