CVE-2026-75838 is a cross-site scripting vulnerability in DOMPurify affecting Red Hat Hardened Images RPMs, notably grafana13.2. The vulnerability arises from incomplete neutralization of detached subtrees during IN_PLACE sanitization when using a custom element-removal hook. An attacker can exploit this by supplying crafted HTML with event handlers, enabling arbitrary JavaScript execution despite apparent sanitization. This flaw requires a specific non-default configuration and user interaction. Red Hat has issued updated RPM packages to fix this vulnerability. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

The vulnerability allows remote attackers to execute arbitrary JavaScript code in the context of the affected application, potentially leading to information disclosure, unauthorized actions, and bypass of protection mechanisms. The impact includes confidentiality and integrity risks, such as theft of user cookies or session tokens and execution of unauthorized commands. However, exploitation requires a non-default DOMPurify configuration and user interaction with malicious content. There are no known exploits in the wild at this time.

Red Hat has released updated RPM packages (grafana13.2-13.2.1-0.6.hum1) that address this vulnerability. Users should apply these updates to remediate the issue. Additionally, to mitigate the vulnerability, avoid using DOMPurify with custom IN_PLACE sanitization configurations that include element-removal hooks. Default DOMPurify configurations are not affected and require no action.