## DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)

- 種別: advisory
- 重大度: high
- 関連技術: nodejs
- 公開日時: 2026-10-22T16:24:52.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-mrv2-3pqr-j5jr)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-mrv2-3pqr-j5jr

影響: npm:dompurify <= 3.4.16 → 3.4.17
The 3.4.16 fix for GHSA-p98j-92pf-mc4p only covers a hook that removes the node it was called for. If an IN_PLACE hook removes a different node, like the current node's parent or a sibling that has not been visited yet, that subtree is never walked or neutralized. Event handlers in it stay on the elements, and an that was already loading fires after sanitize() returns. The README says: "Nodes that a hook detaches from the tree ... are treated as removed. In IN_PLACE mode their subtree is neutra…