org.webjars.npm:dompurify@3.4.13

org.webjars.npm:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in _sanitizeElements and _sanitizeAttributes in src/purify.ts, which invoke _handleHookDetachedNode only after the beforeSanitizeElements and uponSanitizeElement hooks, so a non-root node removed by an afterSanitizeElements or afterSanitizeAttributes hook keeps its descendants' event handlers armed, and the post-walk neutralization pass covers only entries in DOMPurify.removed, which excludes hook-detached nodes. An attacker can execute script in the page origin under the victim's session by supplying markup with a non-root wrapper whose descendants carry on* handlers, such as an <img onerror>, so a queued resource event fires on the detached subtree after the synchronous sanitize() call has returned. This requires the application to call sanitize() with IN_PLACE: true on a live node and to register a node-removing afterSanitizeElements or afterSanitizeAttributes hook, so callers using the default returning mode or no such hooks are unaffected.

Note: This is a bypass of the fix for the vulnerability described in CVE-2026-75838.

Upgrade org.webjars.npm:dompurify to version 3.4.16 or higher.