Critical Vulnerability in node-dompurify: Potential for Mutation Cross-Site Scripting (mXSS)
Summary
UBUNTU-CVE-2025-26791: DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS). Affects node-dompurify versions 2.3.0+dfsg-2 – 2.3.3+dfsg-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-dompurify is a popular JavaScript library used for sanitizing HTML and preventing XSS attacks. It is widely utilized in web applications to ensure that user-generated content does not contain malicious scripts. However, certain versions of node-dompurify are vulnerable to a specific issue that can lead to mutation cross-site scripting (mXSS), compromising the security of applications that rely on it.
Vulnerability Detail
The vulnerability identified as CVE-2025-26791 affects versions of node-dompurify prior to 3.2.4. It stems from an incorrect template literal regular expression, which can be exploited to execute malicious scripts in the context of the user's browser. This can lead to unauthorized access to sensitive information, session hijacking, and other security breaches. The vulnerability has a CVSS score of 4.5, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not possible, consider implementing input validation and sanitization on user-generated content to mitigate the risk of XSS attacks. Additionally, you can restrict the use of certain HTML elements and attributes that are known to be vulnerable.
Conclusion
The vulnerability in node-dompurify poses a significant risk to web applications that utilize this library for sanitizing HTML. It is crucial to update to the latest version to mitigate the risk of mutation cross-site scripting (mXSS). By following the recommended steps and utilizing tools like Vulert, developers can ensure their applications remain secure.
See every vulnerability recorded for node-dompurify →
FAQ
mXSS is a type of XSS attack where an attacker can manipulate the DOM of a web page to execute malicious scripts, often through the use of template literals or other dynamic content.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to user sessions, data theft, and the execution of malicious scripts within the user's browser.
Yes, Vulert provides a service that monitors and alerts you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If you cannot update the package, implement input validation and restrict the use of vulnerable HTML elements to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for node-dompurify.
