AIKIDO-2026-925458
dompurify is vulnerable to Cross-Site Scripting (XSS)
31
Low Risk
This Affects:
dompurifyTL;DR
DOMPurify can sanitize existing DOM nodes in place when the IN_PLACE option is enabled. When a sanitization hook removes a containing element, the sanitizer returns early without neutralizing that element's now-detached descendants, so a descendant such as an image keeps an already-armed event handler. The returned root looks clean, but the retained handler still runs after sanitize() returns once the pending resource event fires. The fix neutralizes the detached subtree before returning from the hook-removal path so queued handlers are stripped.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use IN_PLACE sanitization together with a hook that removes a containing element, so that untrusted HTML with a resource element (for example an img with an onload/onerror handler) can retain an executable handler on the detached subtree.
Background info
dompurify is vulnerable to Cross-Site Scripting (XSS) in versions 0.0.1 - 3.4.12.
How to fix this
Upgrade the dompurify library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant