dompurify

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It runs as JavaScript and works in all modern browsers, as well as in Node.js (via jsdom). DOMPurify is written by security people who have vast background in web a

Latest 3.4.15

NPM

97%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

100

Supply Chain

100

Attestations

Are you affected? Scan for Free

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-404587 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. dompurify is vulnerable to Cross-Site Scripting (XSS) in versions 2.0.0 - 3.4.13.	2.0.0 - 3.4.13	Low
AIKIDO-2026-925458 dompurify is vulnerable to Cross-Site Scripting (XSS) in versions 0.0.1 - 3.4.12.	0.0.1 - 3.4.12	Low
CVE-2026-65898 dompurify is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 3.4.10.	0.0.0 - 3.4.10	Medium
AIKIDO-2026-36958 dompurify is vulnerable to Improper Input Validation in versions 3.0.6 - 3.4.10.	3.0.6 - 3.4.10	Low
CVE-2026-49978 dompurify is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 3.4.6.	0.0.0 - 3.4.6	Medium