Components Vulnerabilities Security Events Pricing MCP API

Find vulnerabilities. Fix fast with AI.

Search components by package, version, or CVE to get started.

org.webjars.npm/dompurify 3.3.1 | Vulnerab… | Sonatype Guide

Get full component data and automated fixes with Sonatype Guide.

Sign up for free

org.webjars.npm

dompurify

3.3.1

dompurify 3.3.1

org.webjars.npm

PublishedDec 20, 2025•Policy

compliance

Developer Trust Score

Recommended Version:x.y.z

Recommended upgrade that meets your policy.

Compare Versions

Severity

Critical (0)

High (0)

Medium (6)

Low (2)

CVSS Score

0.010.0

EPSS Score

0.01.0

Malware

KEV StatusPublished

2.3sonatype-2026-004769

dompurify - hook bypass via CUSTOM_ELEMENT_HANDLING allows XSS

PublishedJul 14, 2026

2.1sonatype-2026-004168

dompurify - Cross-site Scripting (XXS) [CVE-2026-65901]

PublishedJun 22, 2026

5.1sonatype-2026-003513

DOMPurify - SAFE_FOR_TEMPLATES bypass via template expressions in template elements

PublishedJun 2, 2026

5.3sonatype-2026-003390

dompurify - Cross-Site Scripting (XSS) [CVE-2026-49459]

PublishedMay 27, 2026

5.1sonatype-2026-003155

DOMPurify - Cross-Site Scripting (XSS)

PublishedMay 15, 2026

5.1sonatype-2026-002032

DOMPurify - URI validation bypass via predicate function allowlist

PublishedApr 9, 2026

6.1sonatype-2026-001506

DOMPurify - Mutation-XSS via re-contextualization in special wrappers

PublishedMar 28, 2026

5.1CVE-2026-0540

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.

PublishedMar 4, 2026