Packages / dompurify / Security

ModerateVulnerabilityGHSA-8hgg-xxm5-3873CVE-2019-25155Published 14 Nov 2023

DOMPurify Open Redirect vulnerability

Affected releases · dompurify

  • 1.x1.0.0 – 1.0.10Fixed in 1.0.11
  • 0.9.x and older0.4.0 – 0.9.0No fix, no longer updated

On 1.x, the newest line:

npm install dompurify@1.0.11
3.x

  1. Not affected

    3.0.0 – 3.4.17

    50 releases, latest

1.x

  1. Affected

    1.0.0 – 1.0.10

    11 releases

  2. Fixed

    1.0.11 – 1.1.1

    3 releases

0.x

  1. Affected

    0.4.0 – 0.9.0

    29 releases

156 stable releases of dompurify, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for dompurify. It is read in your browser and sent nowhere.

What happens

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute.