Description
DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| cure53 | DOMPurify | 3.1.3 – ≤ 3.3.1, 2.5.3 – ≤ 2.5.8 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-dompurify | 3.3.2+dfsg-1 | — |
| Debian 13 | node-dompurify | No fix yet | — |
| Debian 12 | node-dompurify | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-dompurify | No fix yet | — |
| Ubuntu 26.04 LTS | node-dompurify | No fix yet | — |
| Ubuntu 25.10 | node-dompurify | No fix yet | — |
| Ubuntu 24.04 LTS | node-dompurify | No fix yet | — |
| Ubuntu 22.04 LTS | node-dompurify | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cacti | 1.2.30+git306.82d5aef5-1.1 | openSUSE-SU-2026:10599-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | langfuse-3 +1 | 3.160.0-r1 | — |
| Wolfi rolling | opensearch-dashboards-3 +12 | 3.5.0-r6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | dompurify | >= 3.1.3, < 3.3.2 | 3.3.2 | GHSA-v2wj-7wpq-c8vv |
| npm | dompurify | >= 2.5.3, < 2.5.9 | 2.5.9 | GHSA-v2wj-7wpq-c8vv |
Advisories 5
- WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-2933 Splunk SOAR: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- WID-SEC-2026-1007 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2026
- WID-SEC-2026-2448 Oracle Utilities Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2026
- openSUSE-SU-2026:10599-1 cacti-1.2.30+git306.82d5aef5-1.1 on GA media SUSE / openSUSE Security Updates · Apr 23, 2026
References
- DOMPurify GitHub Repository product
- https://github.com/cure53/DOMPurify/commit/302b51de22535cc90235472c52e3401bedd46f80 patch
- VulnCheck Advisory: DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML release-notes
- https://fluidattacks.com/advisories/daft third-party-advisory
- https://www.vulncheck.com/advisories/dompurify-xss-via-missing-rawtext-elements-in-safe-for-xml third-party-advisory