MEDIUM npm
GHSA-39q2-94rc-95cp DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation
Modified: 4/16/2026
package
npm / dompurify
pkg:npm/dompurify
MEDIUM 6.1 npm
GHSA-63q7-h895-m982 · CVE-2020-26870 Cross-site Scripting in dompurify
Modified: 11/8/2023
MEDIUM 6.1 npm
GHSA-8hgg-xxm5-3873 · CVE-2019-25155 DOMPurify Open Redirect vulnerability
Modified: 11/15/2023
MEDIUM 6.1 npm
GHSA-chqj-j4fh-rw7m · CVE-2019-16728 Cross-Site Scripting in dompurify
Modified: 11/8/2023
MEDIUM npm
GHSA-cj63-jhhr-wcxv DOMPurify USE_PROFILES prototype pollution allows event handlers
Modified: 5/29/2026
MEDIUM npm
GHSA-cjmm-f4jc-qw8r DOMPurify ADD_ATTR predicate skips URI validation
Modified: 5/29/2026
MEDIUM 6.8 npm
GHSA-crv5-9vww-q3g8 · CVE-2026-41239 DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
Modified: 5/5/2026
CRITICAL 10.0 npm
GHSA-gx9m-whjm-85jf · CVE-2024-47875 DOMpurify has a nesting-based mXSS
Modified: 2/4/2026
MEDIUM npm
GHSA-h7mw-gpvr-xq4m · CVE-2026-41240 DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
Modified: 5/5/2026
MEDIUM npm
GHSA-h8r8-wccr-v5f2 DOMPurify is vulnerable to mutation-XSS via Re-Contextualization
Modified: 4/7/2026
CRITICAL npm
GHSA-mjjq-c88q-qhr6 Cross-Site Scripting in dompurify
Modified: 9/29/2021
HIGH 7.0 npm
GHSA-mmhx-hmjr-r674 · CVE-2024-45801 DOMPurify allows tampering by prototype pollution
Modified: 2/4/2026
CRITICAL 9.1 npm
GHSA-p3vf-v8qc-cwcr · CVE-2024-48910 DOMPurify vulnerable to tampering by prototype polution
Modified: 11/3/2025
MEDIUM 6.1 npm
GHSA-v2wj-7wpq-c8vv · CVE-2026-0540 DOMPurify contains a Cross-site Scripting vulnerability
Modified: 3/30/2026
MEDIUM 6.1 npm
GHSA-v8jm-5vwx-cfxm · CVE-2025-15599 DOMPurify contains a Cross-site Scripting vulnerability
Modified: 3/10/2026
MEDIUM 6.9 npm
GHSA-v9jr-rg53-9pgp · CVE-2026-41238 DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback
Modified: 5/5/2026
MEDIUM 4.5 npm
GHSA-vhxf-7vqr-mrjg · CVE-2025-26791 DOMPurify allows Cross-site Scripting (XSS)
Modified: 2/4/2026