Skip to content
OpenAdvisories

Package · Debian

node-dompurify

32 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.2
    CVE-2026-65898

    DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig

    DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attr…

    cure53 DOMPurify dompurify node-dompurify Debian Ubuntu npm
  • High 8.2
    CVE-2026-47423 Public exploit

    DOMPurify XSS via `selectedcontent` re-clone

    DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an XSS payload after sanitization so that unsanitized markup inside <selectedcontent> is re…

    cure53 DOMPurify dompurify node-dompurify Debian Ubuntu npm
  • High 7.5
    CVE-2025-48050

    In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the curre…

    cure53 DOMPurify node-dompurify node-dompurify Debian Ubuntu
  • High 7.3
    CVE-2024-45801

    Tampering by prototype polution in DOMPurify

    DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to…

    cure53 DOMPurify dompurify node-dompurify Debian Ubuntu npm