CVE-2025-15599: DOMPurify Cross-site Scripting Vulnerability
Summary
CVE-2025-15599: DOMPurify contains a Cross-site Scripting vulnerability. Affects dompurify across 2 version ranges.
>= 2.5.3, <= 2.5.8
>= 3.1.3, < 3.2.7
Fixed in 3.2.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DOMPurify is a popular JavaScript library used for sanitizing HTML and preventing XSS (Cross-site Scripting) attacks. It is widely utilized in web applications to ensure that user-generated content is safe to display. The library provides a robust mechanism for cleaning up potentially harmful code while allowing safe HTML elements and attributes. However, certain versions of DOMPurify are vulnerable to a specific XSS attack due to inadequate validation of textarea rawtext elements.
Vulnerability Detail
DOMPurify versions 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability. This flaw allows attackers to bypass attribute sanitization by exploiting missing validation in the SAFE_FOR_XML regex. By including closing rawtext tags like </textarea> in attribute values, attackers can break out of rawtext contexts and execute JavaScript when the sanitized output is placed inside rawtext elements. This vulnerability can lead to unauthorized script execution, potentially compromising user data and application integrity.
How To Fix
Latest published version: 3.4.17 as of 22 Oct 2026
npm install dompurify@3.4.17Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.7
This is the first release that contains the fix.
npm install dompurify@3.2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing additional input validation and sanitization measures in your application to mitigate the risk of XSS attacks. However, this is not a substitute for updating the library.
Conclusion
The DOMPurify library, while essential for sanitizing HTML, has known vulnerabilities in certain versions that can lead to serious security risks. It is crucial for developers to update to the latest patched version to protect their applications from potential XSS attacks.
See every vulnerability recorded for dompurify →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
DOMPurify versions 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized script execution, which may compromise user data and the overall security of the application.
While there is no direct workaround, you can implement additional input validation and sanitization measures to reduce the risk of XSS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for dompurify.
