Packages / dompurify / Security

CriticalVulnerabilityGHSA-mjjq-c88q-qhr6Published 3 Sep 2020

Cross-Site Scripting in dompurify

Affected releases · dompurify

  • 2.x2.0.0 – 2.0.6Fixed in 2.0.7
  • 1.x and older0.4.0 – 1.1.1No fix, no longer updated

On 2.x, the newest line:

npm install dompurify@2.0.7
3.x

  1. Not affected

    3.0.0 – 3.4.17

    50 releases, latest

2.x

  1. Affected

    2.0.0 – 2.0.6

    7 releases

  2. Fixed

    2.0.7 – 2.5.9

    56 releases

1.x

  1. Affected

    1.0.0 – 1.1.1

    14 releases

0.x

  1. Affected

    0.4.0 – 0.9.0

    29 releases

156 stable releases of dompurify, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for dompurify. It is read in your browser and sent nowhere.

What happens

Versions of dompurify prior to 2.0.7 are vulnerable to Cross-Site Scripting (XSS). It is possible to bypass the package sanitization through Mutation XSS, which may allow an attacker to execute arbitrary JavaScript in a victim's browser.

Recommendation

Upgrade to version 2.0.7 or later.