## Environment - dompurify 3.4.15 (current npm release); reproduced independently on jsdom 30.0.1 and 29.1.1 (Node.js 20.x / 26.x) - Config: `DOMPurify.sanitize(node, { IN_PLACE: true })` on a Node input; `SAFE_FOR_XML` at its default (`true`) ## Summary The 3.4.9 fix for the IN_PLACE detached-root class added two protections on the IN_PLACE return path: a fail-closed `TypeError` in `_forceRemove` when a node selected for removal cannot be detached, and a `_neutralizeSubtree` pass (`dist/purify.js` line 1336) that strips non-allowlisted **attributes** from removed subtrees. Both miss the rawtext **text-content** form. When the force-removed root is a rawtext element (`<style>`), the payload lives in the node's *text*: the node detaches fine (the `TypeError` guard is not reached), `_neutralizeSubtree` strips nothing (there are no attributes), and the IN_PLACE exit returns the detached, never-sanitized `<style>` whose text still carries live markup. Serializing that node and re-parsing it in **plain HTML context** materializes the payload — no foreign-content context required. The same Node input sanitized **without** `IN_PLACE` returns an empty result: the only difference is the IN_PLACE return path handing the killed node back. ## Steps to reproduce ```js const { JSDOM } = require('jsdom'); const createDOMPurify = require('dompurify'); // 3.4.15 const window = new JSDOM('').window; const DOMPurify = createDOMPurify(window); const styleRoot = window.document.createElement('style'); styleRoot.setAttribute('onclick', 'alert(1)'); // attribute payload styleRoot.textContent = '</style><img src=x onerror=1>'; // text payload window.document.body.appendChild(styleRoot); const returned = DOMPurify.sanitize(styleRoot, { IN_PLACE: true }); console.log(returned === styleRoot); // true (same node) console.log(styleRoot.parentNode === null); // true (detached) console.log(styleRoot.outerHTML); // <style></style><img src=x onerror=1></style> console.log(styleRoot.getAttribute('onclick')); // null (attribute neutralized) console.log(styleRoot.textContent); // '</style><img src=x onerror=1>' (text survives) // plain HTML reparse (no foreign-content context involved): const probe = window.document.createElement('div'); probe.innerHTML = returned.outerHTML || styleRoot.outerHTML; console.log(probe.querySelectorAll('img').length); // 1 console.log(probe.querySelector('img').getAttribute('onerror')); // "1" ``` Observed on 3.4.15: one node, one call — the `onclick` **attribute** is neutralized while the **text** payload (`</style><img src=x onerror=1>`) survives verbatim; serializing and re-parsing the returned node in plain HTML context materializes the `img` with the live `onerror` handler. Contrast on the same Node input without `IN_PLACE`: `RETURN_DOM: true` → `<body></body>`; `RETURN_DOM_FRAGMENT: true` → 0 children — the payload is fully sanitized away. The only difference is the IN_PLACE return path. Contrast on the removal trigger: `SAFE_FOR_XML: false` → the node is not removed (detached stays false); plain CSS text → not removed. The removal is gated by the mXSS text probes and happens *specifically because* the serialized node would re-open tags on reparse. ## Root cause `_isUnsafeNode` (`dist/purify.js` 3.4.15, lines 1700–1714) removes nodes whose literal text would re-open tags on reparse — shape (b) in the source comment is "text-only content that already carries the element's OWN end tag", detected by the `LITERAL_TEXT_CLOSE` probe (line 385) alongside the `ELEMENT_MARKUP_PROBE` (line 339) rules. `_forceRemove` (line 1122) records the node in `DOMPurify.removed` (`{element}`) and detaches it. The removal is intentional: the upstream comment states these shapes are removed **because the literal serializer emits them verbatim for the HTML parser to re-open**. The IN_PLACE exit then hands the force-removed root back to the caller — the very node whose removal `DOMPurify.removed` just recorded (verified: `DOMPurify.removed.some(e => e.element === root)` is `true` on the returned instance). The 3.4.9 `_neutralizeSubtree` pass (line 1336) addresses only the attribute form — its own docstring: "walks a removed subtree and strips every attribute" (purpose: cancel queued resource events). Rawtext text content is out of its scope, so the removal that was performed *specifically to prevent reparse* is undone by returning the node: you removed it to stop the reparse, then returned it. Differential (one node, one call, same removal path): the `onclick` attribute is neutralized by the existing pass while the text payload survives verbatim — the attribute axis is covered, the text axis is the gap. ## Impact Identical blast radius to the published IN_PLACE family: an application that sanitizes a Node in `IN_PLACE` mode and re-inserts (or serializes and then re-inserts) the result materializes attacker markup in plain HTML context: script execution in the page. Moving the returned node via `appendChild` alone is safe; the round trip through serialization is what fires the payload. No foreign-content context is required with the close-tag payload. ## Affected versions - Verified live: 3.4.15 (current). - Source-verified: the attribute-only `_neutralizeSubtree` and the IN_PLACE return path are present in 3.4.9–3.4.14; releases before 3.4.9 predate the fix entirely (unconditional return; individual pre-3.4.9 releases not dynamically tested). - Per cure53 advisory convention the affected range is reported as `<= 3.4.15` (current at time of writing). ## Suggested remediation **Primary (root-cause, covers every form):** at the IN_PLACE exit, check whether the returned root was recorded during sanitization — `DOMPurify.removed.some(e => e.element === root)` — and fail closed: throw the same `TypeError` style used by the 3.4.9 detach guard ("a node selected for removal could not be safely returned; refusing to sanitize in place"), or return `null`. This is consistent with the existing fail-closed design and covers all present and future root-kill reasons in one check. **Secondary (form-specific):** extend `_neutralizeSubtree` to neutralize **text content of rawtext descendants** — the elements in `LITERAL_TEXT_ELEMENT_NAMES` (`style`, `script`, `xmp`, `iframe`, `noembed`, `noframes`, `plaintext`, `noscript`) — by rewriting `textContent` to a defanged form, matching the probe coverage of `_isUnsafeNode`/`LITERAL_TEXT_CLOSE`. A regression test asserting that a force-removed rawtext root comes back with no `/<[/\w!]/` match in `textContent` (and is not returned at all under the primary fix) prevents re-introduction. ## Prior art / differentiation - GHSA-r47g-fvhr-h676 (fixed 3.4.6): clobbered-form **root** removal — different trigger; this report's root is a normal allowlisted `style` element killed by the text probe. - GHSA-55q2-fjhq-7xh7 (low): IN_PLACE **hook removal** leaves a detached subtree executable — the attribute-form twin (hook-stripped subtree retains onload-class handlers). This report's rawtext **text** form is not covered by `_neutralizeSubtree`'s attribute stripping and is not that advisory. - GHSA-h8r8-wccr-v5f2 (medium): mXSS via re-contextualization in the standard (non-IN_PLACE) serialize path — different mechanism; IN_PLACE is not involved. - The 3.4.9 release notes credit @mozfreedyb for the IN_PLACE handling improvements that this residual escapes on the text axis. ## Applicability scope (stated up front) The payload materializes when the application **serializes and re-parses** the sanitizer output (`innerHTML` assignment, template rendering, markdown/HTML round trips) or otherwise consumes the returned node's markup. Moving the returned node via `appendChild` alone does not trigger it. Applications that pass **live, connected attacker trees** into `IN_PLACE` are explicitly warned against by upstream's own source comment; this report concerns the serialize-and-reinsert consumption pattern that the IN_PLACE mode exists to serve.
PoC: CVE-2026-85097-Toolkit
CVE-2026-85097 – Bricksforge WordPress Plugin Unauth File Upload to RCE Toolkit (CVSS 10.0) | Red/Blue Team suite for Bricksforge Pro Forms < 3.1.8.9. 2 tools: Full Exploit (polyglot upload, web shell, mass scan, OPSEC, SQLite/JSON output) + SafeChecker (version detect, non-intrusive audit). Ethical & educational use only.
PoC: CVE-2026-102489
CVE-2026-102489 exploit in golang
PoC: sqli-cve-2026-102428
PoC: OrdaSoft Joomla OS CCK (com_os_cck) 8.3.15 unauth SQLi —mass+exploit+dork
PoC: debian-on-s23-ultra
A Samsung Galaxy S23 Ultra running Debian 13 as a server. The bootloader is locked, so an app re-establishes root after every reboot: Shizuku, CVE-2026-43499, KernelSU Next late-load, then a Debian chroot with sshd. One APK, quickstart, chroot bootstrap, and notes on everything that did not work.
PoC: CVE-2026-88776
Write-up for CVE-2026-88776
PoC: CVE-2026-80428
ILIAS ≤ 9.21 / 10.9 / 11.2 — Unauthenticated PHP Object Injection (RCE)
PoC: sonicwall-sma-1000-cve-2026-102255
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
PoC: smartermail
CVE-2026-104082, CVE-2026-104083, CVE-2026-104084
PoC: CVE-2026-91737
CVE-2026-91737 Chrome renderer RCE PoC (PDFium)
PoC: CVE-2026-102255
CVE-2026-102255 - Draft or TODO
PoC: CraftCMS-CVE-2026-79987
Authenticated RCE exploit for Craft CMS 5.9.0–5.10.12 (CVE-2026-79987). Time-based save-action oracle + raw-TCP exfil. Verified on vanilla lab.
PoC: kgsl-1905-msm8953
Research notes & harnesses: KGSL SVM use-after-free (CVE-2021-1905) on Qualcomm MSM8953 / Adreno 506 / kernel 3.18 armv7. Credits upstream patches and prior art.
PoC: postgres-basebackup-symlink
PostgreSQL 18.6 - High - Remote - File write - pg_basebackup follows absolute tar symlink leftover of CVE-2026-6475
PoC: CVE-2026-103889
Proof of concept and isolated Docker lab for CVE-2026-103889, an unauthenticated RCE vulnerability in Expivi 3D Product Configurator for WooCommerce ≤ 2.16.2.
PoC: CVE-2026-9586_POC_EXPLOIT
For new CVEs without existing/working/non-mangled POCs
PoC: CVE-2026-91136
CVE-2026-91136 Divi Plus <= 2.4.0 unauthenticated arbitrary file read (mass scanner + exploit)
PoC: langflow-cve-2026-9198
Independent reconstruction, lab validation, and PoC for CVE-2026-9198, the Langflow unauthenticated RCE (fixed in 1.10.1)
PoC: metabase-cve-2026-72898
Independent reconstruction, lab validation, and PoC for CVE-2026-72898 — Metabase unauthenticated SQLi (patched in 0.63.5)
PoC: CVE-2026-15748
Unauthenticated RCE in WordPress Forminator Forms <= 1.56.1 (CVSS 9.8)
PoC: CVE-2026-104286-PoC
PoC CVE-2026-104286 FortiMail
PoC: ReactorWriteUp-HackTheBox
Reactor es una máquina Linux fácil vulnerable a CVE-2025-55182 (React2Shell), RCE sin autenticación en React Server Components. Accedemos como node, crackeamos un hash MD5 de una base de datos SQLite y pivotamos a engineer por SSH. La escalada abusa del flag --inspect de Node.js para ejecutar código como root vía depuración V8.
PoC: CVE-2026-105306
CVE-2026-105306: Token Introspection Audience Bypass via Dynamic Client Registration in Keycloak - Writeup by DungSoCool
PoC: GhostLock-Next
The next implementation of GhostLock CVE-2026-43499
PoC: ElasticRift
A vulnerable-by-design, secure-by-deployment NGINX pipeline centered around the aftermath of CVE-2026-42945 (NGINX Rift).
PoC: CVE-2026-27626
CVE-2026-27626 - OliveTin <3000.10.0 OS command injection via password-typed arguments, escalating to root when OliveTin runs as root.
PoC: Exploit-CVE-2026-40224
CVE-2026-40224: systemd-machined local privilege escalation
PoC: CVE-2026-41940-PoC
cPanel & WHM Authentication Bypass via CVE-2026-41940 explotation
PoC: CVE-2025-57819
FreePBX unauthenticated SQLi (endpoint module)
PoC: CVE-2026-43805
Binary diff analysis and non-destructive PoC for CVE-2026-43805
PoC: diskcache-community
Community-maintained hard fork of grantjenks/python-diskcache: SQLite-backed persistent cache for Python, with a fix path for CVE-2025-69872
PoC: CVE-2026-108592-poc
CVE-2026-108592 — Environment Variable Exposure PoC in mini-swe-agent
PoC: odin-od105-devkit
CVE-2019-2215 temporary root toolkit for Smartisan Nut Pro (OD105)
PoC: CVE-2026-84568
Reproducible macOS automountd research and lab PoCs for CVE-2026-84568 and CVE-2026-84570: fstype path traversal, NFS payload delivery, Gatekeeper behavior, and root code execution.
PoC: cs50-cybersecurity-final-project
Technical analysis of Log4Shell (CVE-2021-44228) for CS50 Cybersecurity.
PoC: CVE-2026-84411
CVE-2026-84411 — MikroTik RouterOS WebFig Integer Underflow Exploit
PoC: CVE-2025-9548
CVE-2025-9548: Lenovo Power Management Driver null-pointer dereference research and gated PoC
PoC: CVE-2026-69414
**CVE-2026-69414** is an elevation of privilege vulnerability in the **Microsoft Malware Protection Engine** (part of Windows Defender / Microsoft Defender Antivirus), publicly referred to as **"RoguePlanet"**. It represents a **patch bypass** of the original vulnerability **CVE-2026-50656**.
PoC: CVE-2026-103690
SQL injection (CWE-89) in itsourcecode Leave Management System 1.0 - CVE-2026-103690 / VulDB VDB-412559
PoC: CVE-2026-102428
CVE-2026-102428 PoC: OrdaSoft Joomla OS CCK (com_os_cck) <=8.3.15 unauth SQLi — order_field/order_direction ORDER BY injection on public listings. Check + mass exploit, POCBIT-102428-OK marker, CVSS 9.3. https://pocbit.org/pocs/cve-2026-102428
PoC: CVE-2026-106445
CVE-2026-106445 — Handlebars 4.0.0–4.7.9 RCE via Function.prototype.constructor bypass (GHSA-p8wg-vrv2-v86f). PoCbit PoC + Docker lab (4.7.9), check/exploit HTTP client, GHSA template chain. Fixed 4.7.10. https://pocbit.org/pocs/cve-2026-106445
PoC: CVE-2026-107806
CVE-2026-107806 — nginx-ui 2.3.8–2.4.x auth RCE via forged backup restore (TestConfigCmd). PoCbit PoC: GET /api/backup, tamper app.ini, POST /api/restore, POST /api/nginx/test. check/exploit, batch url|JWT. Fixed 2.5.0. https://pocbit.org/pocs/cve-2026-107806
PoC: ModelSim-Decryptor
CVE-2021-42023
PoC: CVE-2026-94503
Zombify <= 1.7.7 Unauthenticated Arbitrary File Upload
PoC: CVE-2026-85097
Bricksforge <= 3.1.8.9 Unauthenticated Arbitrary File Upload
PoC: Docker-Lab-CVE-2024-4367
Docker lab to test proof of concepts for CVE-2024-4367. A high-severity type confusion and remote code execution flaw in Firefox PDF.js font handling due to missing type checks (affecting Firefox < 126, Firefox ESR < 115.11, and PDF.js < 4.2.67).
PoC: braces-security-backport
MIT-licensed braces 3.0.3 with reviewed CVE-2026-93687 depth backport; pinned consumption only
PoC: fortimail-cve-2026-104286-response
FortiMail CVE-2026-104286 (CVSS 9.8) 점검·대응 도구 (버전 확인, IoC 점검, 완화·패치 체크리스트)
PoC: telegram-cve-2026-107181
Telegram CVE-2026-107181
PoC: CVE-2026-84520
AppleFDEKeyStore poc
PoC: larkspur-billing
Synthetic-data billing portal pinned to next@14.2.24 (CVE-2025-29927) — test customer for oopsie
PoC: apache-tomcat-security-audit
Penetration test of Apache Tomcat — Ghostcat, CVE-2017-12615 and Struts2/OGNL exploitation with MITRE ATT&CK mapping
PoC: CVE-2026-21589
Atlassian Arbitrary File Read
PoC: honor90-ghostlock
GhostLock (CVE-2026-43499) + KernelSU late-load port for Honor 90 REA-NX9, MagicOS 9.0.0.211 / Android 15 (pure-GKI 5.10.236). Fork of GhostLock-H80GT.
PoC: CVE-2025-34071
RCE in Kerio Control 9.4.5 via unsigned firmware update.
PoC: honor-90gt-mag-an00-root-research
荣耀 90 GT (MAG-AN00) 提权尝试全记录：CVE-2026-64560 移植、堆喷射原语穷举与漏洞判定方法论
PoC: CVE-2026-28775
CVE-2026-28775 SNMP RCE
PoC: CVE-2021-26828
Corrected python code for CVE-2021-26828
PoC: citrix-netscaler-rce-cve-2026-107406
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
PoC: CVE-2026-94597-poc
CVE-2026-94597
PoC: REDMI_Root
Redmi Pad Pro (dizi) 内核 Root 方案 — CVE-2026-43499 select_stack 适配，KernelSU 越狱模式
PoC: exploit-docs
the files/docs for various exploits, such as (LTBEEF, Sh1mmer, CryptoSmite, RMASmoke, aka: CVE-2025-1122, etc.)
PoC: Root-My-Galaxy-Payloads-SM-S928N
Device-specific CVE-2026-43499 payload profile for Galaxy S24 Ultra SM-S928N (S928NKSU6EZIF, Android 17, kernel 6.1.162)
PoC: CVE-2026-55450
CVE-2026-55450
PoC: vulhub-php-cve-2012-1823
Vulhub php/CVE-2012-1823: PHP-CGI Query String Argument Injection (CVE-2012-1823), run with Isoloom
PoC: vulhub-unomi-cve-2020-13942
Vulhub unomi/CVE-2020-13942: Apache Unomi MVEL/OGNL Injection RCE (CVE-2020-13942), run with Isoloom
PoC: vulhub-libssh-cve-2018-10933
Vulhub libssh/CVE-2018-10933: libssh Server Authentication Bypass (CVE-2018-10933), run with Isoloom
PoC: vulhub-spring-cve-2016-4977
Vulhub spring/CVE-2016-4977: Spring Security OAuth2 Whitelabel SpEL RCE (CVE-2016-4977), run with Isoloom
PoC: vulhub-rails-cve-2018-3760
Vulhub rails/CVE-2018-3760: Ruby on Rails Sprockets Path Traversal (CVE-2018-3760), run with Isoloom
PoC: vulhub-h2database-cve-2022-23221
Vulhub h2database/CVE-2022-23221: H2 Database Console JDBC URL RCE (CVE-2022-23221), run with Isoloom
PoC: vulhub-flink-cve-2020-17519
Vulhub flink/CVE-2020-17519: Apache Flink JobManager Directory Traversal (CVE-2020-17519), run with Isoloom
PoC: vulhub-elasticsearch-cve-2014-3120
Vulhub elasticsearch/CVE-2014-3120: Elasticsearch MVEL Dynamic Script RCE (CVE-2014-3120), run with Isoloom
PoC: vulhub-dubbo-cve-2019-17564
Vulhub dubbo/CVE-2019-17564: Apache Dubbo HTTP Protocol Deserialization (CVE-2019-17564), run with Isoloom
PoC: vulhub-cacti-cve-2022-46169
Vulhub cacti/CVE-2022-46169: Cacti remote_agent.php Command Injection (CVE-2022-46169), run with Isoloom
PoC: vulhub-apisix-cve-2020-13945
Vulhub apisix/CVE-2020-13945: Apache APISIX Default Admin Token RCE (CVE-2020-13945), run with Isoloom
PoC: vulhub-spring-cve-2022-22947
Vulhub spring/CVE-2022-22947: Spring Cloud Gateway Actuator Code Injection (CVE-2022-22947), run with Isoloom
PoC: vulhub-redis-cve-2022-0543
Vulhub redis/CVE-2022-0543: Redis Lua Sandbox Escape (CVE-2022-0543), run with Isoloom
PoC: vulhub-jmeter-cve-2018-1297
Vulhub jmeter/CVE-2018-1297: Apache JMeter RMI Deserialization RCE (CVE-2018-1297), run with Isoloom
PoC: vulhub-activemq-cve-2016-3088
Vulhub activemq/CVE-2016-3088: ActiveMQ Fileserver Arbitrary File Write (CVE-2016-3088), run with Isoloom
PoC: vulhub-glassfish-cve-2017-1000028
Vulhub glassfish/CVE-2017-1000028: GlassFish 4.1 Admin Console Arbitrary File Read (CVE-2017-1000028), run with Isoloom
PoC: vulhub-appweb-cve-2018-8715
Vulhub appweb/CVE-2018-8715: Appweb Digest Authentication Bypass (CVE-2018-8715), run with Isoloom
PoC: mhl-off-hook-writeup
a challenge for a CVE-2026-49881
PoC: vulhub-openssh-cve-2018-15473
Vulhub openssh/CVE-2018-15473: OpenSSH 7.7 Username Enumeration (CVE-2018-15473), run with Isoloom
PoC: vulhub-opensmtpd-cve-2020-7247
Vulhub opensmtpd/CVE-2020-7247: OpenSMTPD MAIL FROM Command Injection (CVE-2020-7247), run with Isoloom
PoC: vulhub-nginx-cve-2017-7529
Vulhub nginx/CVE-2017-7529: Nginx Range Filter Integer Overflow (CVE-2017-7529), run with Isoloom
PoC: vulhub-nginx-cve-2013-4547
Vulhub nginx/CVE-2013-4547: Nginx Filename Logic Vulnerability (CVE-2013-4547), run with Isoloom
PoC: vulhub-jetty-cve-2021-28164
Vulhub jetty/CVE-2021-28164: Jetty Ambiguous Path Information Disclosure (CVE-2021-28164), run with Isoloom
PoC: vulhub-imagemagick-cve-2022-44268
Vulhub imagemagick/CVE-2022-44268: ImageMagick PNG Text Chunk Arbitrary File Read (CVE-2022-44268), run with Isoloom
PoC: vulhub-drupal-cve-2014-3704
Vulhub drupal/CVE-2014-3704: Drupal 7.31 Drupalgeddon SQL Injection (CVE-2014-3704), run with Isoloom
PoC: vulhub-joomla-cve-2023-23752
Vulhub joomla/CVE-2023-23752: Joomla Webservice Improper Access Check (CVE-2023-23752), run with Isoloom
PoC: vulhub-httpd-cve-2017-15715
Vulhub httpd/CVE-2017-15715: Apache HTTP Server FilesMatch Newline Bypass (CVE-2017-15715), run with Isoloom
PoC: RMASmoke-v2
RMASmoke main repo. CVE-2025-1122, (But better)
PoC: vulhub-httpd-cve-2021-42013
Vulhub httpd/CVE-2021-42013: Apache HTTP Server 2.4.50 Path Traversal and RCE (CVE-2021-42013), run with Isoloom
PoC: vulhub-couchdb-cve-2017-12635
Vulhub couchdb/CVE-2017-12635: Apache CouchDB Privilege Escalation (CVE-2017-12635), run with Isoloom
PoC: CVE-2026-91940-crawl4ai-Arbitrary-File-Write
CVE-2026-91940: arbitrary file write in crawl4ai <=0.9.2 via the untrusted-config gate (PDFContentScrapingStrategy image_save_dir). Analysis, reproduction harness and verified 0.9.2 vs 0.9.3 boundary.
PoC: vulhub-mysql-cve-2012-2122
Vulhub mysql/CVE-2012-2122: MySQL Authentication Bypass (CVE-2012-2122), run with Isoloom
PoC: vulhub-saltstack-cve-2020-11651
Vulhub saltstack/CVE-2020-11651: SaltStack Master Authentication Bypass (CVE-2020-11651), run with Isoloom
PoC: vulhub-webmin-cve-2019-15107
Vulhub webmin/CVE-2019-15107: Webmin password_change.cgi Pre-Auth RCE (CVE-2019-15107), run with Isoloom
PoC: vulhub-phpunit-cve-2017-9841
Vulhub phpunit/CVE-2017-9841: PHPUnit eval-stdin.php RCE (CVE-2017-9841), run with Isoloom
PoC: vulhub-nacos-cve-2021-29441
Vulhub nacos/CVE-2021-29441: Nacos User-Agent Authentication Bypass (CVE-2021-29441), run with Isoloom
PoC: vulhub-grafana-cve-2021-43798
Vulhub grafana/CVE-2021-43798: Grafana Plugin Path Traversal (CVE-2021-43798), run with Isoloom
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free