Packages / dompurify / Security

ModerateVulnerabilityGHSA-v8jm-5vwx-cfxmCVE-2025-15599Published 3 Mar 2026

DOMPurify contains a Cross-site Scripting vulnerability

Affected releases · dompurify

  • 3.x3.1.3 – 3.2.6Fixed in 3.2.7
  • 2.x2.5.3 – 2.5.8Fixed in 2.5.9

On 3.x, the newest line:

npm install dompurify@3.2.7
3.x

  1. Not affected

    3.0.0 – 3.1.2

    15 releases

  2. Affected

    3.1.3 – 3.2.6

    12 releases

  3. Fixed

    3.2.7 – 3.4.17

    23 releases, latest

2.x

  1. Not affected

    2.0.0 – 2.5.2

    56 releases

  2. Affected

    2.5.3 – 2.5.8

    6 releases

  3. Fixed

    2.5.9

    1 release

156 stable releases of dompurify, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for dompurify. It is read in your browser and sent nowhere.

What happens

DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like </textarea> in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.