CVE-2019-25155: DOMPurify Open Redirect vulnerability in dompurify
Summary
CVE-2019-25155: DOMPurify Open Redirect vulnerability. Affects dompurify versions < 1.0.11. Fixed in 1.0.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
DOMPurify is an open-source JavaScript library that provides a secure way to sanitize HTML and prevent cross-site scripting (XSS) attacks. It is commonly used in web applications to sanitize user-generated content before rendering it in the browser. However, a vulnerability has been discovered in versions prior to 1.0.11 that allows for reverse tabnabbing in certain scenarios.
Vulnerability Detail
The vulnerability in DOMPurify arises from the lack of a 'rel="noopener noreferrer"' attribute in links in the demos/hooks-target-blank-demo.html file. This omission enables an attacker to perform a reverse tabnabbing attack, where a malicious website can manipulate the target of a link opened in a new tab or window. This can lead to various security risks, such as phishing attacks or the execution of malicious code in the context of the target website.
How To Fix
Latest published version: 3.4.17 as of 22 Oct 2026
npm install dompurify@3.4.17Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.11
This is the first release that contains the fix.
npm install dompurify@1.0.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to manually add the 'rel="noopener noreferrer"' attribute to the affected links in the demos/hooks-target-blank-demo.html file. The following code snippet demonstrates how to add the attribute to an anchor element:
<a href="https://example.com" target="_blank" rel="noopener noreferrer">Link</a>
Conclusion
The DOMPurify Open Redirect vulnerability in dompurify can be mitigated by updating the package to version 1.0.11 or later. This update includes the necessary attribute to prevent reverse tabnabbing attacks. If immediate updating is not possible, manually adding the attribute to the affected links can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dompurify →
FAQ
DOMPurify is a JavaScript library that sanitizes HTML and prevents cross-site scripting (XSS) attacks by removing potentially dangerous elements and attributes from user-generated content.
Reverse tabnabbing is a type of attack where a malicious website manipulates the target of a link opened in a new tab or window. This can be used for phishing attacks or executing malicious code in the context of the target website.
The vulnerability allows an attacker to perform reverse tabnabbing attacks on applications that use DOMPurify. This can lead to security risks such as phishing attacks or the execution of malicious code in the context of the target website.
To fix the vulnerability, update the DOMPurify package to version 1.0.11 or later. Alternatively, manually add the 'rel="noopener noreferrer"' attribute to the affected links in the demos/hooks-target-blank-demo.html file.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for dompurify.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
