CVE-2020-26870: Cross-site Scripting in dompurify
Summary
CVE-2020-26870: Cross-site Scripting in dompurify. Affects dompurify versions < 2.0.17. Fixed in 2.0.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dompurify is an npm package that provides a DOM sanitizer to prevent cross-site scripting (XSS) attacks. It is commonly used to sanitize user-generated content before rendering it in web applications. However, versions before 2.0.17 of Dompurify are vulnerable to a mutation XSS attack. This occurs when a serialize-parse roundtrip does not return the original DOM tree, leading to a change in namespace from HTML to MathML. An attacker can exploit this vulnerability by nesting FORM elements, potentially allowing them to execute malicious scripts in the context of the affected user's browser.
Vulnerability Detail
The vulnerability in Dompurify allows for cross-site scripting attacks, which can have severe consequences for web applications. By injecting malicious scripts into the rendered content, an attacker can steal sensitive user information, manipulate the application's behavior, or perform actions on behalf of the user. This vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Latest published version: 3.4.17 as of 22 Oct 2026
npm install dompurify@3.4.17Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.17
This is the first release that contains the fix.
npm install dompurify@2.0.17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Dompurify to mitigate the risk of cross-site scripting attacks.
Conclusion
In conclusion, the Dompurify package before version 2.0.17 is vulnerable to cross-site scripting attacks. It is crucial for developers to upgrade to the fixed version to mitigate the risk of exploitation. By following the recommended steps and keeping dependencies up to date, you can ensure the security of your web application. For additional support, please contact DevNack.com.
See every vulnerability recorded for dompurify →
FAQ
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can be used to steal sensitive information, manipulate the page's content, or perform actions on behalf of the user.
If your application uses an older version of Dompurify (before 2.0.17), it is susceptible to cross-site scripting attacks. An attacker can exploit this vulnerability to inject and execute malicious scripts in the context of your application's users, potentially leading to unauthorized access, data theft, or other malicious activities.
While specific exploits targeting this vulnerability have not been disclosed publicly, it is crucial to address the issue promptly by upgrading to the fixed version of Dompurify. By doing so, you can prevent potential attacks and ensure the security of your application.
The vulnerability is specific to the Dompurify package. However, it is always recommended to keep all dependencies up to date to mitigate the risk of other vulnerabilities that may impact your application.
For further support and assistance in remediating this vulnerability, you can reach out to info@devnack.com. Our team of experts will be happy to assist you in securing your application.
Related vulnerabilities
Recent vulnerabilities recorded for dompurify.
