GitHub Advisoryadvisory · npm

GHSA-v8jm-5vwx-cfxm DOMPurify contains a Cross-site Scripting vulnerability

MEDIUM Published 2026-03-03 Modified 2026-03-04 Official page ↗
Aliases
CVE-2025-15599
Ecosystem
npm
Packages
dompurify
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2026-03-04

Affected packages

• npm dompurify: >= 3.1.3, < 3.2.7 → fixed in 3.2.7 • npm dompurify: >= 2.5.3, <= 2.5.8 (no fix yet)

Description

DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.

Related

Alias · CVE (1)

  • CVE-2025-15599 DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References