Packages / dompurify / Security

ModerateVulnerabilityGHSA-v2wj-7wpq-c8vvCVE-2026-0540Published 3 Mar 2026

DOMPurify contains a Cross-site Scripting vulnerability

Affected releases · dompurify

  • 3.x3.1.3 – 3.3.1Fixed in 3.3.2
  • 2.x2.5.3 – 2.5.8Fixed in 2.5.9

On 3.x, the newest line:

npm install dompurify@3.3.2
3.x

  1. Not affected

    3.0.0 – 3.1.2

    15 releases

  2. Affected

    3.1.3 – 3.3.1

    15 releases

  3. Fixed

    3.3.2 – 3.4.17

    20 releases, latest

2.x

  1. Not affected

    2.0.0 – 2.5.2

    56 releases

  2. Affected

    2.5.3 – 2.5.8

    6 releases

  3. Fixed

    2.5.9

    1 release

156 stable releases of dompurify, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for dompurify. It is read in your browser and sent nowhere.

What happens

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in 2.5.9 and 3.3.2, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.