dompurify vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-CG2G-XH64-V4Q7Criticaldompurify: DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modesGHSA-MRV2-3PQR-J5JRHighdompurify: DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for…GHSA-C6GR-QVV4-5V3FLowdompurify: DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xmlGHSA-6688-9RHM-GJV2Lowdompurify: DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executesGHSA-P98J-92PF-MC4PLowdompurify: DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSSGHSA-55Q2-FJHQ-7XH7Mediumdompurify: DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSSCVE-2026-66010Lowdompurify: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.CVE-2026-65898Mediumdompurify: DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution…CVE-2026-65899Lowdompurify: DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` outputCVE-2026-65900Lowdompurify: DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modesCVE-2026-49978Mediumdompurify: DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.contentCVE-2026-65901Lowdompurify: DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via…CVE-2026-65902Mediumdompurify: DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` /…CVE-2026-49458Mediumdompurify: DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checksCVE-2026-49459Mediumdompurify: DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOMCVE-2026-47423Highdompurify: DOMPurify XSS via selectedcontent re-cloneCVE-2026-41240Mediumdompurify: DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)CVE-2026-41239Mediumdompurify: DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM modeCVE-2026-41238Mediumdompurify: DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING FallbackCVE-2026-65903Mediumdompurify: DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluationCVE-2026-65912Mediumdompurify: DOMPurify ADD_ATTR predicate skips URI validationCVE-2026-65913Mediumdompurify: DOMPurify USE_PROFILES prototype pollution allows event handlersCVE-2026-65914Mediumdompurify: DOMPurify is vulnerable to mutation-XSS via Re-Contextualization CVE-2026-0540Mediumdompurify: DOMPurify contains a Cross-site Scripting vulnerabilityCVE-2025-15599Mediumdompurify: DOMPurify contains a Cross-site Scripting vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo