CVE-2026-116803 affects DOMPurify, the HTML sanitization library embedded in countless web applications, in versions released before 3.4.17. The bug lives in the library's IN_PLACE sanitization mode: when a hook strips out a parent or sibling element, any event handlers left behind in that removed markup can stay live and trigger once the sanitize() call completes. That gap lets attacker-supplied HTML, such as an image tag with an onerror handler, execute script in the page, a classic DOM-based cross-site scripting outcome.
// source: nvd.nist.gov ↗