DO
Product
DOMPurify
34
CVEs
0
On KEV
9.8
Max CVSS
5
New 30D
Severity mix
Critical 1High 2Medium 31Low 0
Watch
Add DOMPurify to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-48910 | 9.8 | Oct 31 | DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG Affected: before 2.4.2 |
| CVE-2026-47423 | 8.2 | Jul 14 | DOMPurify XSS via `selectedcontent` re-clone Affected: >= 3.4.4, < 3.4.5 |
| CVE-2026-65898 | 7.2 | Jul 23 | DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig Affected: before 3.4.11 |
| CVE-2026-41238 | 6.9 | Apr 23 | DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback Affected: >= 3.0.1, < 3.4.0 |
| CVE-2026-41239 | 6.8 | Apr 23 | DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode Affected: >= 1.0.10, < 3.4.0 |
| CVE-2026-116804 New | 6.1 | Oct 26 | DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content Affected: 3.4.4 before 3.4.17 |
| CVE-2026-116803 New | 6.1 | Oct 26 | DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees Affected: before 3.4.17 |
| CVE-2026-116802 New | 6.1 | Oct 26 | DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode Affected: before 3.4.17 |
| CVE-2026-109345 | 6.1 | Oct 12 | DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root Affected: before 3.4.16 |
| CVE-2026-109344 | 6.1 | Oct 12 | DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks Affected: 3.4.13 before 3.4.16 |
| CVE-2026-66010 | 6.1 | Jul 24 | DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING Affected: before 3.4.12 |
| CVE-2026-65914 | 6.1 | Jul 23 | DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization Affected: before 3.3.2 |
| CVE-2026-65913 | 6.1 | Jul 23 | DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES Affected: before 3.3.2 |
| CVE-2026-65912 | 6.1 | Jul 23 | DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR Affected: before 3.3.2 |
| CVE-2026-65911 | 6.1 | Jul 23 | DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage Affected: before 3.4.0 |
| CVE-2026-65903 | 6.1 | Jul 23 | DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS Affected: before 3.4.0 |
| CVE-2026-65902 | 6.1 | Jul 23 | DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags Affected: before 3.4.7 |
| CVE-2026-65901 | 6.1 | Jul 23 | DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName Affected: through 3.4.6 |
| CVE-2026-65900 | 6.1 | Jul 23 | DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM Affected: 3.0.0 before 3.4.8 |
| CVE-2026-65899 | 6.1 | Jul 23 | DOMPurify before 3.4.9 Trusted Types Policy State Contamination Affected: before 3.4.9 |
| CVE-2026-49978 | 6.1 | Jul 14 | DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content Affected: < 3.4.6 |
| CVE-2026-49459 | 6.1 | Jul 14 | DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM Affected: < 3.4.6 |
| CVE-2026-49458 | 6.1 | Jul 14 | DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks Affected: < 3.4.6 |
| CVE-2026-41240 | 6.1 | Apr 23 | DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) Affected: < 3.4.0 |
| CVE-2026-0540 | 6.1 | Mar 3 | DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML Affected: 3.1.3 through 3.3.1; 2.5.3 through 2.5.8 |
| CVE-2025-15599 | 6.1 | Mar 3 | DOMPurify XSS via Textarea Rawtext Bypass in SAFE_FOR_XML Affected: 3.1.3 through 3.2.6; 2.5.3 through 2.5.8 |
| CVE-2025-26791 | 6.1 | Feb 14 | DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS) Affected: before 3.2.4 |
| CVE-2024-47875 | 6.1 | Oct 11 | DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG Affected: before 2.5.0; 3.0.0 before 3.1.3 |
| CVE-2024-45801 | 6.1 | Sep 16 | DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG Affected: before 2.5.4; 3.0.0 before 3.1.3 |
| CVE-2019-25155 | 6.1 | Nov 7 | DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute Affected: before 1.0.11 |
| CVE-2020-26870 | 6.1 | Oct 7 | Cure53 DOMPurify before 2.0.17 allows mutation XSS Affected: before 2.0.17 |
| CVE-2019-16728 | 6.1 | Sep 24 | DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari Affected: before 2.0.1 |
| CVE-2026-75838 | 5.1 | Aug 18 | DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook Affected: before 3.4.13 |
| CVE-2026-65904 | 4.7 | Jul 23 | DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode Affected: through 3.3.3 |
Showing 34