AIKIDO-2026-404587

dompurify is vulnerable to Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS) Pre-CVE Published Aug 21, 2026

Low Risk

This Affects:

dompurify

2.0.0 - 3.4.13

Fixed in 3.4.14

Are you affected? Scan for Free

TL;DR

DOMPurify sanitizes HTML to prevent cross-site scripting, but its handling of literal-text (rawtext) elements and attribute removal can be bypassed to produce mutation XSS. When an application allow-lists risky literal-text tags such as style, xmp, noembed, noframes, or noscript, their raw text content is serialized literally and re-opens markup when the output is reparsed as HTML, smuggling executable elements past sanitization. Dangerous attributes carrying uppercase names, such as event handlers or javascript: URLs, also survive name-based attribute removal in mixed XML and HTML document contexts and become active after serialization. The fix extends reparse protection to all literal-text elements and removes attributes by their exact node so case-preserved names are stripped.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application allow-lists risky literal-text tags such as style, xmp, noembed, or noscript, or sanitizes markup parsed in mixed XML and HTML document contexts.