cure53/dompurify Security Advisories | GitStock

critical2026-10-22

DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes

GHSA-cg2g-xh64-v4q7

high2026-10-22

DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)

GHSA-mrv2-3pqr-j5jr

low2026-10-22

DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

GHSA-c6gr-qvv4-5v3f

low2026-10-05

DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes

GHSA-6688-9rhm-gjv2

low2026-09-30

DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS

GHSA-p98j-92pf-mc4p

medium2026-08-07

DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

GHSA-55q2-fjhq-7xh7

low2026-07-21

DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.

GHSA-c2j3-45gr-mqc4 · CVE-2026-66010

medium2026-06-18

DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)

GHSA-cmwh-pvxp-8882 · CVE-2026-65898

low2026-06-15

DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output

GHSA-vxr8-fq34-vvx9 · CVE-2026-65899

low2026-06-15

DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes

GHSA-gvmj-g25r-r7wr · CVE-2026-65900

medium2026-06-15

DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

GHSA-rp9w-3fw7-7cwq · CVE-2026-49978

low2026-06-15

DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects

GHSA-x4vx-rjvf-j5p4 · CVE-2026-65901

medium2026-06-15

DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`

GHSA-76mc-f452-cxcm · CVE-2026-65902

medium2026-06-15

DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

GHSA-hpcv-96wg-7vj8 · CVE-2026-49458

medium2026-06-15

DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

GHSA-r47g-fvhr-h676 · CVE-2026-49459

high2026-06-01

DOMPurify XSS via selectedcontent re-clone

GHSA-87xg-pxx2-7hvx · CVE-2026-47423

medium2026-04-22

DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

GHSA-h7mw-gpvr-xq4m · CVE-2026-41240

medium2026-04-22

DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

GHSA-crv5-9vww-q3g8 · CVE-2026-41239

medium2026-04-22

DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback

GHSA-v9jr-rg53-9pgp · CVE-2026-41238

medium2026-04-16

DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation

GHSA-39q2-94rc-95cp · CVE-2026-65903