dompurify (npm)
DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
Advisories
70
Latest version
3.4.17
Released Oct 12, 2026
License
Apache-2.0 OR MPL-2.0
OpenSSF Scorecard
9.7 / 10
How to fix
Upgrading to 3.4.17 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install dompurify@3.4.17yarn
yarn add dompurify@3.4.17pnpm
pnpm add dompurify@3.4.17Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-cg2g-xh64-v4q7 DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes |
Critical EPSS 0.18% |
>= 3.4.4, < 3.4.17 | 3.4.17 |
| GHSA-cg2g-xh64-v4q7 DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes |
Critical EPSS 0.18% |
>= 3.4.4, <= 3.4.16 | No fix yet |
| GHSA-mrv2-3pqr-j5jr DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p) |
High EPSS 0.16% |
<= 3.4.16 | No fix yet |
| GHSA-mrv2-3pqr-j5jr DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p) |
High EPSS 0.16% |
< 3.4.17 | 3.4.17 |
| GHSA-c6gr-qvv4-5v3f DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml |
Medium EPSS 0.22% |
< 3.4.17 | 3.4.17 |
| GHSA-c6gr-qvv4-5v3f DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml |
Medium EPSS 0.22% |
<= 3.4.16 | No fix yet |
| GHSA-6688-9rhm-gjv2 DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes |
Medium EPSS 0.25% |
< 3.4.16 | 3.4.16 |
| GHSA-6688-9rhm-gjv2 DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes |
Medium EPSS 0.25% |
<= 3.4.15 | No fix yet |
| GHSA-p98j-92pf-mc4p DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS |
Low EPSS 0.19% |
>= 3.4.13, < 3.4.16 | 3.4.16 |
| GHSA-p98j-92pf-mc4p DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS |
Low EPSS 0.19% |
>= 3.4.13, <= 3.4.15 | No fix yet |
| GHSA-55q2-fjhq-7xh7 DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS |
Medium EPSS 0.39% |
< 3.4.13 | 3.4.13 |
| GHSA-55q2-fjhq-7xh7 DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS |
Medium EPSS 0.39% |
<= 3.4.12 | No fix yet |
| GHSA-jxrp-r7gx-q4j8 Duplicate Advisory: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements. Withdrawn |
Medium | <= 3.4.11 | No fix yet |
| GHSA-jxrp-r7gx-q4j8 Duplicate Advisory: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements. Withdrawn |
Medium | <= 3.4.11 | No fix yet |
| GHSA-c2j3-45gr-mqc4 DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements. |
Low EPSS 0.21% |
<= 3.4.11 | No fix yet |
| GHSA-c2j3-45gr-mqc4 DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements. |
Low EPSS 0.21% |
< 3.4.12 | 3.4.12 |
| GHSA-cmwh-pvxp-8882 DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch) |
Medium EPSS 0.21% |
<= 3.4.10 | No fix yet |
| GHSA-cmwh-pvxp-8882 DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch) |
Medium EPSS 0.21% |
< 3.4.11 | 3.4.11 |
| GHSA-vxr8-fq34-vvx9 DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output |
Low EPSS 0.41% |
< 3.4.9 | 3.4.9 |
| GHSA-vxr8-fq34-vvx9 DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output |
Low EPSS 0.41% |
< 3.4.9 | 3.4.9 |
| GHSA-gvmj-g25r-r7wr DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes |
Low EPSS 0.31% |
>= 3.0.0, < 3.4.8 | 3.4.8 |
| GHSA-gvmj-g25r-r7wr DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes |
Low EPSS 0.31% |
>= 3.0.0, <= 3.4.7 | No fix yet |
| GHSA-rp9w-3fw7-7cwq DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content |
Medium EPSS 0.40% |
< 3.4.7 | 3.4.7 |
| GHSA-rp9w-3fw7-7cwq DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content |
Medium EPSS 0.40% |
<= 3.4.6 | No fix yet |
| GHSA-x4vx-rjvf-j5p4 DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects |
Medium EPSS 0.29% |
<= 3.4.6 | No fix yet |
| GHSA-x4vx-rjvf-j5p4 DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects |
Medium EPSS 0.29% |
<= 3.4.6 | No fix yet |
| GHSA-76mc-f452-cxcm DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR` |
Medium EPSS 0.36% |
< 3.4.7 | 3.4.7 |
| GHSA-76mc-f452-cxcm DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR` |
Medium EPSS 0.36% |
< 3.4.7 | 3.4.7 |
| GHSA-hpcv-96wg-7vj8 DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks |
Medium EPSS 0.40% |
<= 3.4.5 | No fix yet |
| GHSA-hpcv-96wg-7vj8 DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks |
Medium EPSS 0.40% |
< 3.4.6 | 3.4.6 |
| GHSA-r47g-fvhr-h676 DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM |
Medium EPSS 0.36% |
<= 3.4.5 | No fix yet |
| GHSA-r47g-fvhr-h676 DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM |
Medium EPSS 0.36% |
< 3.4.6 | 3.4.6 |
| GHSA-87xg-pxx2-7hvx DOMPurify XSS via selectedcontent re-clone |
High EPSS 0.41% |
No fix yet | |
| GHSA-87xg-pxx2-7hvx DOMPurify XSS via selectedcontent re-clone |
High EPSS 0.41% |
>= 3.4.4, < 3.4.5 | 3.4.5 |
| GHSA-h7mw-gpvr-xq4m DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) |
Medium EPSS 0.31% |
< 3.4.0 | 3.4.0 |
| GHSA-h7mw-gpvr-xq4m DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) |
Medium EPSS 0.31% |
< 3.4.0 | 3.4.0 |
| GHSA-crv5-9vww-q3g8 DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode |
Medium EPSS 0.25% |
>= 1.0.10, < 3.4.0 | 3.4.0 |
| GHSA-crv5-9vww-q3g8 DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode |
Medium EPSS 0.25% |
>= 1.0.10, < 3.4.0 | 3.4.0 |
| GHSA-v9jr-rg53-9pgp DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback |
Medium EPSS 0.27% |
>= 3.0.1, < 3.4.0 | 3.4.0 |
| GHSA-v9jr-rg53-9pgp DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback |
Medium EPSS 0.27% |
>= 3.0.1, < 3.4.0 | 3.4.0 |
| GHSA-39q2-94rc-95cp DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation |
Medium EPSS 0.33% |
< 3.4.0 | 3.4.0 |
| GHSA-39q2-94rc-95cp DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation |
Medium EPSS 0.33% |
<= 3.3.3 | No fix yet |
| GHSA-cjmm-f4jc-qw8r DOMPurify ADD_ATTR predicate skips URI validation |
Medium EPSS 0.30% |
<= 3.3.1 | No fix yet |
| GHSA-cjmm-f4jc-qw8r DOMPurify ADD_ATTR predicate skips URI validation |
Medium EPSS 0.30% |
< 3.3.2 | 3.3.2 |
| GHSA-cj63-jhhr-wcxv DOMPurify USE_PROFILES prototype pollution allows event handlers |
Medium EPSS 0.32% |
<= 3.3.1 | No fix yet |
| GHSA-cj63-jhhr-wcxv DOMPurify USE_PROFILES prototype pollution allows event handlers |
Medium EPSS 0.32% |
< 3.3.2 | 3.3.2 |
| GHSA-h8r8-wccr-v5f2 DOMPurify is vulnerable to mutation-XSS via Re-Contextualization |
Medium EPSS 0.31% |
< 3.3.2 | 3.3.2 |
| GHSA-h8r8-wccr-v5f2 DOMPurify is vulnerable to mutation-XSS via Re-Contextualization |
Medium EPSS 0.31% |
< 3.3.2 | 3.3.2 |
| GHSA-v2wj-7wpq-c8vv DOMPurify contains a Cross-site Scripting vulnerability |
Medium EPSS 0.39% |
>= 3.1.3, <= 3.3.1 | No fix yet |
| GHSA-v2wj-7wpq-c8vv DOMPurify contains a Cross-site Scripting vulnerability |
Medium EPSS 0.39% |
>= 2.5.3, <= 2.5.8 | No fix yet |
| GHSA-v2wj-7wpq-c8vv DOMPurify contains a Cross-site Scripting vulnerability |
Medium EPSS 0.39% |
>= 3.1.3, < 3.3.2 | 3.3.2 |
| GHSA-v2wj-7wpq-c8vv DOMPurify contains a Cross-site Scripting vulnerability |
Medium EPSS 0.39% |
>= 2.5.3, < 2.5.9 | 2.5.9 |
| GHSA-v8jm-5vwx-cfxm DOMPurify contains a Cross-site Scripting vulnerability |
Medium EPSS 0.29% |
>= 3.1.3, < 3.2.7 | 3.2.7 |
| GHSA-v8jm-5vwx-cfxm DOMPurify contains a Cross-site Scripting vulnerability |
Medium EPSS 0.29% |
>= 2.5.3, <= 2.5.8 | No fix yet |
| GHSA-v8jm-5vwx-cfxm DOMPurify contains a Cross-site Scripting vulnerability |
Medium EPSS 0.29% |
>= 2.5.3, <= 2.5.8 | No fix yet |
| GHSA-v8jm-5vwx-cfxm DOMPurify contains a Cross-site Scripting vulnerability |
Medium EPSS 0.29% |
>= 3.1.3, < 3.2.7 | 3.2.7 |
| GHSA-vhxf-7vqr-mrjg DOMPurify allows Cross-site Scripting (XSS) |
Medium EPSS 0.60% |
< 3.2.4 | 3.2.4 |
| GHSA-vhxf-7vqr-mrjg DOMPurify allows Cross-site Scripting (XSS) |
Medium EPSS 0.60% |
< 3.2.4 | 3.2.4 |
| GHSA-p3vf-v8qc-cwcr DOMPurify vulnerable to tampering by prototype polution |
Critical EPSS 1.15% |
< 2.4.2 | 2.4.2 |
| GHSA-p3vf-v8qc-cwcr DOMPurify vulnerable to tampering by prototype polution |
Critical EPSS 1.15% |
< 2.4.2 | 2.4.2 |
| GHSA-gx9m-whjm-85jf DOMpurify has a nesting-based mXSS |
High EPSS 1.13% |
>= 3.0.0, < 3.1.3 | 3.1.3 |
| GHSA-gx9m-whjm-85jf DOMpurify has a nesting-based mXSS |
High EPSS 1.13% |
< 2.5.0 | 2.5.0 |
| GHSA-gx9m-whjm-85jf DOMpurify has a nesting-based mXSS |
High EPSS 1.13% |
>= 3.0.0, < 3.1.3 | 3.1.3 |
| GHSA-gx9m-whjm-85jf DOMpurify has a nesting-based mXSS |
High EPSS 1.13% |
< 2.5.0 | 2.5.0 |
| GHSA-mmhx-hmjr-r674 DOMPurify allows tampering by prototype pollution |
Medium EPSS 0.89% |
< 2.5.4 | 2.5.4 |
| GHSA-mmhx-hmjr-r674 DOMPurify allows tampering by prototype pollution |
Medium EPSS 0.89% |
>= 3.0.0, < 3.1.3 | 3.1.3 |
| GHSA-8hgg-xxm5-3873 DOMPurify Open Redirect vulnerability |
Medium EPSS 0.51% |
< 1.0.11 | 1.0.11 |
| GHSA-63q7-h895-m982 Cross-site Scripting in dompurify |
Medium EPSS 4.88% |
< 2.0.17 | 2.0.17 |
| GHSA-mjjq-c88q-qhr6 Cross-Site Scripting in dompurify |
Critical | < 2.0.7 | 2.0.7 |
| GHSA-chqj-j4fh-rw7m Cross-Site Scripting in dompurify |
Medium EPSS 1.46% |
< 2.0.3 | 2.0.3 |
Source: git://github.com/cure53/DOMPurify.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor