Skip to content
OpenAdvisories

Package · Debian

node-dompurify

32 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.2
    CVE-2026-47423 Public exploit

    DOMPurify XSS via `selectedcontent` re-clone

    DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an XSS payload after sanitization so that unsanitized markup inside <selectedcontent> is re…

    cure53 DOMPurify dompurify node-dompurify Debian Ubuntu npm
  • Critical 9.1
    CVE-2024-48910 Public exploit

    DOMPurify vulnerable to tampering by prototype polution

    DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.

    cure53 DOMPurify cacti dompurify Debian Ubuntu npm
  • Critical 10.0
    CVE-2024-47875 Public exploit

    DOMPurify nesting-based mXSS

    DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.

    cure53 DOMPurify cacti dompurify Debian Ubuntu npm