dompurify vulnerabilities
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It runs as JavaScript and works in all modern browsers, as well as in Node.js (via jsdom). DOMPurify is written by security people who have vast background in web a
- Registry
- npm
- Latest
- 3.4.17
- License
- (MPL-2.0 OR Apache-2.0)
33 known advisories
The latest version, 3.4.17, is not affected by any of them. Projects on older versions may be.
npm install dompurify@3.4.17Security advisories for dompurify
DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
- Affected
- >=3.4.4 <3.4.17
- Fixed in
- 3.4.17
DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
- Affected
- <3.4.17
- Fixed in
- 3.4.17
DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
- Affected
- <3.4.17
- Fixed in
- 3.4.17
DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
- Affected
- <3.4.16
- Fixed in
- 3.4.16
DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
- Affected
- >=3.4.13 <3.4.16
- Fixed in
- 3.4.16
DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS
- Affected
- <3.4.13
- Fixed in
- 3.4.13
DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.
- Affected
- <3.4.12
- Fixed in
- 3.4.12
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
- Affected
- <3.4.11
- Fixed in
- 3.4.11
DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output
- Affected
- <3.4.9
- Fixed in
- 3.4.9
DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes
- Affected
- >=3.0.0 <3.4.8
- Fixed in
- 3.4.8
DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
- Affected
- <3.4.7
- Fixed in
- 3.4.7
DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects
- Affected
- <=3.4.6
- Fixed in
- No fix released
DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`
- Affected
- <3.4.7
- Fixed in
- 3.4.7
DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
- Affected
- <3.4.6
- Fixed in
- 3.4.6
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
- Affected
- <3.4.6
- Fixed in
- 3.4.6
DOMPurify XSS via selectedcontent re-clone
- Affected
- >=3.4.4 <3.4.5
- Fixed in
- 3.4.5
DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
- Affected
- <3.4.0
- Fixed in
- 3.4.0
DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
- Affected
- >=1.0.10 <3.4.0
- Fixed in
- 3.4.0
DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback
- Affected
- >=3.0.1 <3.4.0
- Fixed in
- 3.4.0
DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation
- Affected
- <3.4.0
- Fixed in
- 3.4.0
DOMPurify ADD_ATTR predicate skips URI validation
- Affected
- <3.3.2
- Fixed in
- 3.3.2
DOMPurify USE_PROFILES prototype pollution allows event handlers
- Affected
- <3.3.2
- Fixed in
- 3.3.2
DOMPurify is vulnerable to mutation-XSS via Re-Contextualization
- Affected
- <3.3.2
- Fixed in
- 3.3.2
DOMPurify contains a Cross-site Scripting vulnerability
- Affected
- >=3.1.3 <3.3.2 · >=2.5.3 <2.5.9
- Fixed in
- 2.5.9, 3.3.2
DOMPurify contains a Cross-site Scripting vulnerability
- Affected
- >=3.1.3 <3.2.7 · >=2.5.3 <=2.5.8
- Fixed in
- 3.2.7
DOMPurify allows Cross-site Scripting (XSS)
- Affected
- <3.2.4
- Fixed in
- 3.2.4
DOMPurify vulnerable to tampering by prototype polution
- Affected
- <2.4.2
- Fixed in
- 2.4.2
DOMpurify has a nesting-based mXSS
- Affected
- <2.5.0 · >=3.0.0 <3.1.3
- Fixed in
- 2.5.0, 3.1.3
DOMPurify allows tampering by prototype pollution
- Affected
- <2.5.4 · >=3.0.0 <3.1.3
- Fixed in
- 2.5.4, 3.1.3
DOMPurify Open Redirect vulnerability
- Affected
- <1.0.11
- Fixed in
- 1.0.11
Cross-site Scripting in dompurify
- Affected
- <2.0.17
- Fixed in
- 2.0.17
Cross-Site Scripting in dompurify
- Affected
- <2.0.7
- Fixed in
- 2.0.7
Cross-Site Scripting in dompurify
- Affected
- <2.0.3
- Fixed in
- 2.0.3
Which of your client projects still run an old dompurify?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.