Is dompurify 0.9 vulnerable?
npm · 1 release from 0.9.0 to 0.9.0 · latest dompurify is 3.4.17 · checked 2 Nov 2026
Yes: 25 known advisories
Yes. dompurify 0.9.0, the last 0.9 release, is affected by 25 known security advisories (2 critical, 3 high, 15 medium, 5 low), including CVE-2024-48910, CVE-2026-116803, CVE-2024-47875. At least one has no fixed release yet.
Advisories affecting dompurify 0.9.0
DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
- Affected
- <3.4.17
- Fixed in
- 3.4.17
DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
- Affected
- <3.4.17
- Fixed in
- 3.4.17
DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
- Affected
- <3.4.16
- Fixed in
- 3.4.16
DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS
- Affected
- <3.4.13
- Fixed in
- 3.4.13
DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.
- Affected
- <3.4.12
- Fixed in
- 3.4.12
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
- Affected
- <3.4.11
- Fixed in
- 3.4.11
DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output
- Affected
- <3.4.9
- Fixed in
- 3.4.9
DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
- Affected
- <3.4.7
- Fixed in
- 3.4.7
DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects
- Affected
- <=3.4.6
- Fixed in
- No fix released
DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`
- Affected
- <3.4.7
- Fixed in
- 3.4.7
DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
- Affected
- <3.4.6
- Fixed in
- 3.4.6
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
- Affected
- <3.4.6
- Fixed in
- 3.4.6
DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
- Affected
- <3.4.0
- Fixed in
- 3.4.0
DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation
- Affected
- <3.4.0
- Fixed in
- 3.4.0
DOMPurify ADD_ATTR predicate skips URI validation
- Affected
- <3.3.2
- Fixed in
- 3.3.2
DOMPurify USE_PROFILES prototype pollution allows event handlers
- Affected
- <3.3.2
- Fixed in
- 3.3.2
DOMPurify is vulnerable to mutation-XSS via Re-Contextualization
- Affected
- <3.3.2
- Fixed in
- 3.3.2
DOMPurify allows Cross-site Scripting (XSS)
- Affected
- <3.2.4
- Fixed in
- 3.2.4
DOMPurify vulnerable to tampering by prototype polution
- Affected
- <2.4.2
- Fixed in
- 2.4.2
DOMpurify has a nesting-based mXSS
- Affected
- <2.5.0 · >=3.0.0 <3.1.3
- Fixed in
- 2.5.0, 3.1.3
DOMPurify allows tampering by prototype pollution
- Affected
- <2.5.4 · >=3.0.0 <3.1.3
- Fixed in
- 2.5.4, 3.1.3
DOMPurify Open Redirect vulnerability
- Affected
- <1.0.11
- Fixed in
- 1.0.11
Cross-site Scripting in dompurify
- Affected
- <2.0.17
- Fixed in
- 2.0.17
Cross-Site Scripting in dompurify
- Affected
- <2.0.7
- Fixed in
- 2.0.7
Cross-Site Scripting in dompurify
- Affected
- <2.0.3
- Fixed in
- 2.0.3
Which of your client projects are still on dompurify 0.9?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact dompurify version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other dompurify versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.