GHSA-55q2-fjhq-7xh7: DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

August 7, 2026

During IN_PLACE sanitization, a hook that removes an element can leave that element’s detached descendants executable. A descendant image can retain its attacker-provided onload handler and fire after sanitize() returns, even though the returned root is clean and the image remains disconnected from the document.

References

github.com/advisories/GHSA-55q2-fjhq-7xh7
github.com/cure53/DOMPurify/commit/3067f7746769
github.com/cure53/DOMPurify/pull/1557
github.com/cure53/DOMPurify/releases/tag/3.4.13
github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7

Code Behaviors & Features

Detect and mitigate GHSA-55q2-fjhq-7xh7 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →