CVE-2019-16728: Cross-Site Scripting in dompurify
Summary
CVE-2019-16728: Cross-Site Scripting in dompurify. Affects dompurify versions < 2.0.3. Fixed in 2.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dompurify is an npm package that provides a DOM-only, super-fast, and secure HTML sanitizer. It is commonly used to sanitize user-generated HTML content to prevent cross-site scripting (XSS) attacks. However, versions prior to 2.0.3 are vulnerable to a specific type of XSS attack.
Vulnerability Detail
The vulnerability in dompurify is due to a filter bypass that allows for Cross-Site Scripting (XSS) attacks. This bypass occurs through a combination of <svg>/<math> elements and </p>/</br>. Attackers can exploit this vulnerability by injecting malicious JavaScript code into a victim's browser, bypassing the XSS protection. An example payload is: <svg></p><style><a id="</style><img src=1 onerror=alert(1)>">. This can lead to arbitrary code execution in the victim's browser.
How To Fix
Latest published version: 3.4.17 as of 22 Oct 2026
npm install dompurify@3.4.17Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.3
This is the first release that contains the fix.
npm install dompurify@2.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A workaround for this vulnerability is to manually sanitize user-generated HTML content using other sanitization libraries or custom code. However, this approach may not provide the same level of security and convenience as using dompurify.
Conclusion
In conclusion, the dompurify package prior to version 2.0.3 is vulnerable to Cross-Site Scripting (XSS) attacks. It is crucial to upgrade to the latest version or apply the recommended configuration to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dompurify →
FAQ
Dompurify is an npm package that provides a fast and secure HTML sanitizer for sanitizing user-generated HTML content.
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The XSS filter bypass in dompurify occurs through a combination of specific HTML elements and closing tags, allowing attackers to inject malicious JavaScript code.
This vulnerability can lead to arbitrary code execution in a victim's browser, allowing attackers to perform actions on behalf of the victim, such as stealing sensitive information or performing unauthorized actions.
Yes, upgrading to version 2.0.3 or later of the dompurify package fixes this vulnerability. Alternatively, you can disallow the use of specific HTML elements through configuration.
Related vulnerabilities
Recent vulnerabilities recorded for dompurify.
