Bug 2561474 (CVE-2026-116803)
| Summary: | CVE-2026-116803 dompurify: DOMPurify: Cross-site scripting via unneutralized detached elements during in-place sanitization | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in DOMPurify. This vulnerability allows a remote attacker to conduct cross-site scripting (XSS) attacks by supplying specially crafted markup. When an application processes content using in-place sanitization hooks that remove surrounding elements, the library fails to neutralize event handlers on detached elements. Consequently, malicious scripts can execute in the context of the victim's browser session, potentially compromising sensitive user data.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-10-26 23:21:53 UTC
|