CVE-2026-75838 describes a cross-site scripting vulnerability in DOMPurify versions prior to 3.4.13. The vulnerability occurs during the in-place sanitization process where element-removal hooks fail to neutralize detached subtrees. Attackers can exploit this by providing HTML containing event handlers on descendant elements that execute after the sanitization completes, bypassing the intended sanitization protections.

An attacker can inject malicious scripts that execute in the context of the victim's browser despite the use of DOMPurify for sanitization. This can lead to typical XSS impacts such as session hijacking, defacement, or other client-side attacks. The CVSS 4.0 score of 5.1 indicates a medium severity with network attack vector, low attack complexity, and requiring user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to DOMPurify version 3.4.13 or later once available. Until then, consider additional input validation or alternative sanitization methods to mitigate risk.