npm

dompurify

28 Total advisories

28 Vulnerabilities

0 Malware

Dependency scanning

Check whether dompurify is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

dompurify

Vulnerabilities

DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.

DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)

DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback

DOMPurify is vulnerable to mutation-XSS via Re-Contextualization

DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects

DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes

DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`

DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

DOMPurify ADD_ATTR predicate skips URI validation

DOMPurify USE_PROFILES prototype pollution allows event handlers

DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation

DOMPurify contains a Cross-site Scripting vulnerability

DOMPurify contains a Cross-site Scripting vulnerability

DOMpurify has a nesting-based mXSS

DOMPurify allows tampering by prototype pollution

DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output

DOMPurify allows Cross-site Scripting (XSS)

DOMPurify XSS via selectedcontent re-clone

DOMPurify vulnerable to tampering by prototype polution

DOMPurify Open Redirect vulnerability

Cross-site Scripting in dompurify

Cross-Site Scripting in dompurify

Cross-Site Scripting in dompurify

Browse more npm advisories

Start Securing