CVE-2024-47875: DOMPurify Nesting-Based mXSS Vulnerability
Summary
CVE-2024-47875: DOMpurify has a nesting-based mXSS. Affects dompurify across 2 version ranges.
< 2.5.0
>= 3.0.0, < 3.1.3
Fixed in 2.5.0 or 3.1.3, depending on the release line you run. How to fix ↓
Also tracked for
- cacti · Debian:11
The same CVE-2024-47875 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
DOMPurify is a popular JavaScript library used for sanitizing HTML and preventing cross-site scripting (XSS) attacks. It is widely utilized in web applications to ensure that user-generated content is safe to display. The library effectively removes malicious scripts and harmful elements from HTML, making it a crucial tool for developers aiming to enhance the security of their applications. However, a recent vulnerability has been identified that affects specific versions of DOMPurify, allowing for nesting-based mXSS attacks.
Vulnerability Detail
The vulnerability in DOMPurify arises from its handling of nested HTML elements, which can lead to a type of cross-site scripting (XSS) known as mXSS (malicious cross-site scripting). This issue allows attackers to inject malicious scripts into web applications, potentially compromising user data and session information. The vulnerability is particularly concerning because it can be exploited without user interaction, making it a high-risk issue for applications that rely on DOMPurify for sanitization. The affected versions are prior to 2.5.0 and 3.1.3, where the flaw was introduced and subsequently patched.
How To Fix
Latest published version: 3.4.17 as of 22 Oct 2026
npm install dompurify@3.4.17Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.02.5.0npm install dompurify@2.5.0 -
>= 3.0.0, < 3.1.33.1.3npm install dompurify@3.1.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing a temporary workaround by sanitizing user inputs more rigorously before passing them to DOMPurify. This can include stripping out potentially harmful nested elements manually or using additional libraries to validate and clean the input data before processing it with DOMPurify.
Conclusion
The DOMPurify library is essential for web application security, but the recently discovered nesting-based mXSS vulnerability poses a significant risk. It is crucial for developers to update to the latest patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities in your projects effectively.
See every vulnerability recorded for dompurify →
FAQ
DOMPurify is a JavaScript library designed to sanitize HTML and prevent XSS attacks by removing malicious scripts and harmful elements from user-generated content.
mXSS stands for malicious cross-site scripting, a type of XSS attack that exploits vulnerabilities in web applications to inject malicious scripts without user interaction.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized access to user data, session hijacking, and other malicious activities that compromise the security of web applications.
Yes, Vulert provides a service that monitors and alerts you in real-time for open-source vulnerabilities in your software using just the package-lock.json file.
References
Related vulnerabilities
Recent vulnerabilities recorded for dompurify.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
