CVE-2026-75838 is a cross-site scripting vulnerability in the DOMPurify library that occurs during IN_PLACE sanitization when element-removal hooks fail to neutralize detached subtrees. This allows remote attackers to execute malicious scripts by providing crafted HTML with event handlers, even after sanitization appears complete. The vulnerability affects Red Hat products using DOMPurify with a custom IN_PLACE sanitization configuration involving an element-removal hook. The flaw does not affect default DOMPurify configurations. Red Hat released updated RPMs for grafana13.2 as part of Red Hat Hardened Images to address this vulnerability.

The vulnerability enables remote attackers to execute arbitrary JavaScript in the context of affected applications, potentially leading to information disclosure or unauthorized actions. The impact includes confidentiality and integrity loss due to the execution of unauthorized code. Exploitation requires user interaction with specially crafted content and use of a non-default DOMPurify configuration. Default configurations are not vulnerable. There are no known exploits in the wild at this time.

Red Hat has released updated RPM packages for Red Hat Hardened Images including grafana13.2-13.2.1-0.7.hum1 that address this vulnerability. Users should apply these updates to remediate the issue. Additionally, to mitigate the vulnerability, avoid using DOMPurify with a custom IN_PLACE sanitization configuration that includes an element-removal hook. Default DOMPurify configurations are not affected and do not require changes.