Verified

ghsa:GHSA-6688-9RHM-GJV2: dompurify <= 3.4.15

DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes. Affected range: <= 3.4.15. Fixed version: 3.4.16.

Affected technology

dompurify · <= 3.4.15
Vendor not specified by the source

Component: Not specified by the source

What an attacker can do

The source does not specify what an attacker can achieve.

Published 12-Oct-2026 10:15 UTC

Product: dompurify
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-06 00:14:20.210633+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-6688-9rhm-gjv2.html