Path Traversal Vulnerability in node-dompurify: Insecure Pathname Handling
Summary
CVE-2025-48050: In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. Affects node-dompurify versions < 6bc6d60e49256f27a4022181b7d8a5b0721fd534. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-dompurify is a popular JavaScript library used for sanitizing HTML and preventing XSS attacks. It is widely utilized in web applications to ensure that user-generated content is safe for rendering in browsers. The library's primary function is to clean potentially harmful scripts and tags from HTML input, making it essential for maintaining web security. However, a recent vulnerability has been identified that affects its pathname handling, which could lead to unauthorized access to sensitive files.
Vulnerability Detail
The vulnerability, identified as CVE-2025-48050, arises from the fact that in versions of DOMPurify prior to commit 6bc6d60, the scripts/server.js file does not properly validate that a given pathname is located within the current working directory. This oversight can allow an attacker to exploit the pathname handling, potentially leading to unauthorized file access or manipulation. The implications of this vulnerability are significant, as it could expose sensitive information or allow for further exploitation of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in your code to validate the pathnames before processing them. For example, you can restrict the pathnames to only allow those that start with the current working directory. Here is a sample code snippet:
const path = require('path');
const fs = require('fs');
function validatePathname(inputPath) {
const currentDir = process.cwd();
const resolvedPath = path.resolve(currentDir, inputPath);
if (resolvedPath.startsWith(currentDir)) {
return true;
}
return false;
}
// Usage
if (validatePathname(userInputPath)) {
// Proceed with processing
} else {
// Handle invalid pathname
}
Conclusion
The CVE-2025-48050 vulnerability in node-dompurify highlights the importance of proper pathname validation in software libraries. By updating to the latest version and implementing additional checks, developers can protect their applications from potential exploitation. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for node-dompurify →
FAQ
CVE-2025-48050 is a vulnerability in the node-dompurify package that allows improper pathname handling, potentially leading to unauthorized file access.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. You can use the Vulert playground at Vulert Scanner without any signup.
The risks include unauthorized access to sensitive files and potential exploitation of the system, which could lead to data breaches or further attacks.
You can update the package by running the command 'npm install node-dompurify@latest' in your terminal.
Yes, a patched version of node-dompurify is available. It is recommended to update to the latest version to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-dompurify.
