Packages / dompurify / Security

ModerateVulnerabilityGHSA-vhxf-7vqr-mrjgCVE-2025-26791Published 14 Feb 2025

DOMPurify allows Cross-site Scripting (XSS)

Affected releases · dompurify

  • 3.x3.0.0 – 3.2.3Fixed in 3.2.4
  • 2.x2.0.0 – 2.5.9No fix on this line yet
  • 1.x and older0.4.0 – 1.1.1No fix, no longer updated

On 3.x, the newest line:

npm install dompurify@3.2.4
3.x

  1. Affected

    3.0.0 – 3.2.3

    24 releases

  2. Fixed

    3.2.4 – 3.4.17

    26 releases, latest

2.x

  1. Affected

    2.0.0 – 2.5.9

    63 releases

1.x

  1. Affected

    1.0.0 – 1.1.1

    14 releases

0.x

  1. Affected

    0.4.0 – 0.9.0

    29 releases

156 stable releases of dompurify, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for dompurify. It is read in your browser and sent nowhere.

What happens

DOMPurify before 3.2.4 has an incorrect template literal regular expression when SAFE_FOR_TEMPLATES is set to true, sometimes leading to mutation cross-site scripting (mXSS).