DOMPurify XSS Vulnerability - Cross-site Scripting Risk in dompurify Package
Summary
CVE-2025-26791: DOMPurify allows Cross-site Scripting (XSS). Affects dompurify versions < 3.2.4. Fixed in 3.2.4. How to fix ↓
Also tracked for
- node-dompurify · Debian:12
The same CVE-2025-26791 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DOMPurify is a popular JavaScript library used for sanitizing HTML and preventing XSS attacks. It allows developers to safely render user-generated content by removing harmful scripts and elements. However, prior to version 3.2.4, DOMPurify contained a flaw in its template literal regular expression, which could lead to mutation cross-site scripting (mXSS) vulnerabilities, compromising the security of applications that rely on it.
Vulnerability Detail
The vulnerability arises from an incorrect regular expression used in DOMPurify's template literal handling, which can allow attackers to inject malicious scripts into web applications. This can lead to unauthorized actions being performed on behalf of users, data theft, and other security breaches. The issue is classified under CWE-79, which pertains to improper neutralization of input during web page generation ('Cross-site Scripting').
How To Fix
Latest published version: 3.4.17 as of 22 Oct 2026
npm install dompurify@3.4.17Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.4
This is the first release that contains the fix.
npm install dompurify@3.2.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the package, consider implementing additional input validation and sanitization measures in your application to mitigate the risk of XSS attacks. However, this is not a substitute for updating the package.
Conclusion
The DOMPurify package has a known vulnerability that can lead to cross-site scripting attacks if not addressed. It is crucial for developers to update to version 3.2.4 or later to mitigate this risk. Regular monitoring of dependencies using tools like Vulert can help maintain application security.
See every vulnerability recorded for dompurify →
FAQ
The CVSS score of this vulnerability is 4.5, indicating a moderate severity level.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access, data theft, and the execution of malicious scripts in the context of the user's session.
Yes, implementing additional input validation and sanitization can help reduce the risk of XSS attacks until you can update the package.
The incorrect regular expression can allow attackers to bypass DOMPurify's sanitization, leading to potential XSS vulnerabilities in applications that rely on it.
References
Related vulnerabilities
Recent vulnerabilities recorded for dompurify.
