What is GHSA-748c-f84h-hp2v?

GHSA-748c-f84h-hp2v is a security advisory published by GitHub Security Advisories with Medium severity. DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization...

Which CVE IDs does GHSA-748c-f84h-hp2v cover?

GHSA-748c-f84h-hp2v covers the following CVE IDs: CVE-2026-75838. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-748c-f84h-hp2vMedium

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization...

Vendor

GitHub Security Advisories

Published

August 18, 2026

Last Modified

August 18, 2026

🔗 CVE IDs covered (1)

CVE-2026-75838 →

📋 Description

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

🔗 References (4)

https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7
https://nvd.nist.gov/vuln/detail/CVE-2026-75838
https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook
https://github.com/advisories/GHSA-748c-f84h-hp2v