MEDIUMnpm
GHSA-39q2-94rc-95cp· CVE-2026-65903DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation
Modified: 9/10/2026
package
npm/dompurify
pkg:npm/dompurify
MEDIUMnpm
GHSA-55q2-fjhq-7xh7· CVE-2026-75838DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS
Modified: 9/10/2026
MEDIUM6.1npm
GHSA-63q7-h895-m982· CVE-2020-26870Cross-site Scripting in dompurify
Modified: 11/8/2023
MEDIUM6.1npm
GHSA-76mc-f452-cxcm· CVE-2026-65902DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`
Modified: 9/10/2026
HIGH8.2npm
GHSA-87xg-pxx2-7hvx· CVE-2026-47423DOMPurify XSS via selectedcontent re-clone
Modified: 6/1/2026
MEDIUM6.1npm
GHSA-8hgg-xxm5-3873· CVE-2019-25155DOMPurify Open Redirect vulnerability
Modified: 11/15/2023
LOWnpm
GHSA-c2j3-45gr-mqc4· CVE-2026-66010DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.
Modified: 9/10/2026
MEDIUM6.1npm
GHSA-chqj-j4fh-rw7m· CVE-2019-16728Cross-Site Scripting in dompurify
Modified: 11/8/2023
MEDIUMnpm
GHSA-cj63-jhhr-wcxv· CVE-2026-65913DOMPurify USE_PROFILES prototype pollution allows event handlers
Modified: 9/10/2026
MEDIUMnpm
GHSA-cjmm-f4jc-qw8r· CVE-2026-65912DOMPurify ADD_ATTR predicate skips URI validation
Modified: 9/10/2026
MEDIUMnpm
GHSA-cmwh-pvxp-8882· CVE-2026-65898DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
Modified: 9/10/2026
MEDIUM6.8npm
GHSA-crv5-9vww-q3g8· CVE-2026-41239DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
Modified: 9/10/2026
LOWnpm
GHSA-gvmj-g25r-r7wr· CVE-2026-65900DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes
Modified: 9/10/2026
CRITICAL10.0npm
GHSA-gx9m-whjm-85jf· CVE-2024-47875DOMpurify has a nesting-based mXSS
Modified: 9/10/2026
MEDIUMnpm
GHSA-h7mw-gpvr-xq4m· CVE-2026-41240DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
Modified: 9/10/2026
MEDIUMnpm
GHSA-h8r8-wccr-v5f2· CVE-2026-65914DOMPurify is vulnerable to mutation-XSS via Re-Contextualization
Modified: 9/10/2026
MEDIUM6.1npm
GHSA-hpcv-96wg-7vj8· CVE-2026-49458DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
Modified: 9/10/2026
CRITICALnpm
GHSA-mjjq-c88q-qhr6Cross-Site Scripting in dompurify
Modified: 9/29/2021
HIGH7.0npm
GHSA-mmhx-hmjr-r674· CVE-2024-45801DOMPurify allows tampering by prototype pollution
Modified: 9/10/2026
CRITICAL9.1npm
GHSA-p3vf-v8qc-cwcr· CVE-2024-48910DOMPurify vulnerable to tampering by prototype polution
Modified: 11/3/2025
MEDIUM6.1npm
GHSA-r47g-fvhr-h676· CVE-2026-49459DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
Modified: 9/10/2026
MEDIUMnpm
GHSA-rp9w-3fw7-7cwq· CVE-2026-49978DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
Modified: 9/10/2026
MEDIUM6.1npm
GHSA-v2wj-7wpq-c8vv· CVE-2026-0540DOMPurify contains a Cross-site Scripting vulnerability
Modified: 9/10/2026
MEDIUM6.1npm
GHSA-v8jm-5vwx-cfxm· CVE-2025-15599DOMPurify contains a Cross-site Scripting vulnerability
Modified: 9/10/2026
MEDIUM6.9npm
GHSA-v9jr-rg53-9pgp· CVE-2026-41238DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback
Modified: 9/10/2026
MEDIUM4.5npm
GHSA-vhxf-7vqr-mrjg· CVE-2025-26791DOMPurify allows Cross-site Scripting (XSS)
Modified: 9/10/2026
LOWnpm
GHSA-vxr8-fq34-vvx9· CVE-2026-65899DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output
Modified: 9/10/2026
LOWnpm
GHSA-x4vx-rjvf-j5p4· CVE-2026-65901DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects
Modified: 9/10/2026