dompurify vulnerabilities — 36 matching vulnerabilities

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed — no installation and no source-code access required.

Scan your app free →

Severity	Vulnerability	Package	Ecosystem	Disclosed	Fixed version
9.2 critical	GHSA-cg2g-xh64-v4q7: DOMPurify template-expression bypass in attached shadow roots	`dompurify`	npm	22 Oct 2026	3.4.17
7.6 high	GHSA-mrv2-3pqr-j5jr: DOMPurify IN_PLACE hooks can leave detached event handlers active	`dompurify`	npm	22 Oct 2026	3.4.17
Low	GHSA-c6gr-qvv4-5v3f: DOMPurify XHTML-mode SVG sanitization allows click-triggered XSS	`dompurify`	npm	22 Oct 2026	3.4.17
Low	DOMPurify Vulnerability: IN_PLACE Mode Allows Rawtext Payload Execution	`dompurify`	npm	05 Oct 2026	3.4.16
2.3 low	DOM XSS Vulnerability in DOMPurify: Node-Removing Hook Leaves Event Handlers Armed	`dompurify`	npm	30 Sep 2026	3.4.16
5.1 medium	XSS Vulnerability in DOMPurify: Risk of Executable Detached Subtree	`dompurify`	npm	07 Aug 2026	3.4.13
6.1 medium	DOMPurify Vulnerability: CUSTOM_ELEMENT_HANDLING Bypass in Version 3.4.11	`dompurify`	npm	24 Jul 2026	No fix published
2.1 low	DOMPurify Custom Element Handling Bypass Vulnerability - CVE-2026-XXXX	`dompurify`	npm	21 Jul 2026	3.4.12
5.1 medium	Persistent ALLOWED_ATTR Pollution in DOMPurify: A Security Flaw	`dompurify`	npm	18 Jun 2026	3.4.11
2.1 low	DOMPurify Vulnerability: Trusted Types Policy Persistence After Clear Config	`dompurify`	npm	15 Jun 2026	3.4.9
2.0 low	DOMPurify Vulnerability: SAFE_FOR_TEMPLATES Bypass in Version 3.4.7	`dompurify`	npm	15 Jun 2026	3.4.8
5.1 medium	CVE-2026-49978: DOMPurify Sanitization Bypass via Shadow DOM in <template>	`dompurify`	npm	15 Jun 2026	3.4.7
Low	XSS Vulnerability in DOMPurify 3.4.6: Trusting Attacker-Controlled Node Names	`dompurify`	npm	15 Jun 2026	No fix published
6.1 medium	Persistent Pollution Vulnerability in DOMPurify: Hook Mutation of Allowed Tags and Attributes	`dompurify`	npm	15 Jun 2026	3.4.7
6.1 medium	CVE-2026-49458: DOMPurify Cross-Realm IN_PLACE Sanitization Vulnerability	`dompurify`	npm	15 Jun 2026	3.4.6
6.1 medium	CVE-2026-49459: DOMPurify XSS Vulnerability via IN_PLACE Mode Attribute Preservation	`dompurify`	npm	15 Jun 2026	3.4.6
8.2 high	CVE-2026-47423: DOMPurify XSS Vulnerability via selectedcontent Re-clone	`dompurify`	npm	01 Jun 2026	3.4.5
6.0 medium	CVE-2026-41240: DOMPurify Vulnerability Allows Bypass of FORBID_TAGS with Function-Based ADD_TAGS	`dompurify`	npm	22 Apr 2026	3.4.0
6.8 medium	CVE-2026-41239: DOMPurify SAFE_FOR_TEMPLATES Bypass in RETURN_DOM Mode	`dompurify`	npm	22 Apr 2026	3.4.0
6.9 medium	CVE-2026-41238: DOMPurify Prototype Pollution Vulnerability Leading to XSS Bypass	`dompurify`	npm	22 Apr 2026	3.4.0

Subscribe to Vulert on Telegram

Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.

Join the channel →

Questions

Searching the database

How do I search for a CVE or a package?

Type a CVE id, package name, ecosystem or keyword into the search field. Results include the severity, the affected package, the ecosystem, the disclosure date and the fixed version.

Can I filter by severity or by whether a fix exists?

Yes. The filters on the left narrow the list to critical, high, medium or low vulnerabilities, to a single ecosystem, and to vulnerabilities that have a fix available or none yet.

What does "No fix published" mean?

No patched version has been released for that vulnerability yet. The vulnerability page still shows the affected range and any workaround that can reduce exposure in the meantime.