AIKIDO-2026-10314
isomorphic-dompurify is vulnerable to Protection Mechanism Failure
66
Medium Risk
This Affects:
isomorphic-dompurifyTL;DR
Affected versions of isomorphic-dompurify expose the DOMPurify instance through the global DOMPurify object. Because this global can be defined or modified before the library initializes, malicious code running in the same process could override the sanitizer implementation. This may allow attackers to tamper with or disable HTML sanitization, potentially leading to the processing of unsafe content and increasing the risk of cross-site scripting (xss) in applications relying on the sanitizer. The issue is addressed by removing the global DOMPurify singleton and relying on module-scoped instances instead.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
isomorphic-dompurify is vulnerable to Protection Mechanism Failure in versions 0.0.1 - 2.36.0.
How to fix this
Upgrade the isomorphic-dompurify library to a patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant