CVE-2026-0540: DOMPurify Cross-site Scripting Vulnerability
Summary
CVE-2026-0540: DOMPurify contains a Cross-site Scripting vulnerability. Affects dompurify across 2 version ranges.
>= 2.5.3, <= 2.5.8
>= 3.1.3, <= 3.3.1
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
DOMPurify is a popular JavaScript library used for sanitizing HTML and preventing XSS (Cross-site Scripting) attacks. It is widely utilized in web applications to ensure that user-generated content is safe to display. The library works by removing potentially harmful elements and attributes from the HTML input, making it a crucial tool for developers aiming to secure their applications. However, certain versions of DOMPurify have been found to have vulnerabilities that could allow attackers to bypass its sanitization mechanisms.
Vulnerability Detail
The vulnerability identified as CVE-2026-0540 affects DOMPurify versions 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8. It arises from the library's failure to properly sanitize certain rawtext elements, specifically noscript, xmp, noembed, noframes, and iframe, within the SAFE_FOR_XML regex. This oversight allows attackers to inject malicious payloads into attribute values, which can lead to the execution of JavaScript code when the sanitized output is rendered in unprotected contexts. For example, an attacker could exploit this vulnerability by including a payload like </noscript><img src=x onerror=alert(1)> in the input, leading to potential XSS attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround involves implementing additional validation and sanitization on user inputs before passing them to DOMPurify. This can help mitigate the risk of XSS attacks until the package is updated.
Conclusion
The CVE-2026-0540 vulnerability in DOMPurify poses a significant risk of XSS attacks due to improper sanitization of certain HTML elements. It is crucial for developers using affected versions to update to the latest secure releases to protect their applications from potential exploitation.
See every vulnerability recorded for dompurify →
FAQ
CVE-2026-0540 is a Cross-site Scripting vulnerability found in specific versions of the DOMPurify library, allowing attackers to bypass sanitization.
The affected versions are DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
If you cannot update immediately, consider implementing additional input validation and sanitization as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for dompurify.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
