Skip to content
OpenAdvisories
Medium DLA-2419-1 2 CVEs

dompurify.js - security update

Published Oct 29, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 dompurify.js 0.8.2~dfsg1-1+deb9u1

Vulnerabilities 2

  • Medium 6.1
    CVE-2019-16728

    Cross-Site Scripting in dompurify

    DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.

    dompurify dompurify.js Ubuntu npm
  • Medium 6.1
    CVE-2020-26870

    Cross-site Scripting in dompurify

    Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.

    dompurify dompurify.js Ubuntu npm