CVE-2024-45801

CVE-2024-45801 – DOMPurify prototype pollution/XSS issue : DOMPurify can bypass depth checks via special nesting and, separately, through prototype pollution weakening depth validation. The GHSA advisory details a prototype-pollution chain where Object.prototype.tagNameCheck and Object.prototype....

CVE-2024-47875

CVE-2024-47875 affects DOMPurify and is a nesting-based mXSS vulnerability in DOMPurify’s HTML/MathML/SVG sanitization. The initial entry notes fixes in DOMPurify versions 2.5.0 and 3.1.3. Connected sources further confirm the issue is tracked across ecosystems (e.g., node-dompurify), with Debian...

CVE-2025-26791

DOMPurify is affected by an mXSS flaw in which an incorrect template-literal regular expression in versions before 3.2.4 can lead to mutation cross-site scripting. The CVE-2025-26791 entry is referenced across IBM notices for IBM Db2 Data Management Console, IBM Watson-related products, and other...

CVE-2024-48910

CVE-2024-48910 affects DOMPurify, a DOM-only XSS sanitizer. The vulnerability is a prototype pollution issue in DOMPurify that could enable remote code execution or similar impact as described in multiple sources. The fixed versions cited in the initial document include 2.4.2 for the DOMPurify is...

CVE-2020-26870

CVE-2020-26870 affects DOMPurify up to 2.0.16/2.0.17, where a serialize-parse roundtrip can alter the DOM (namespace changes HTML→MathML, e.g., nesting FORM elements), enabling a mutation XSS. The issue is documented by Cure53 and linked analyses; a fix was released with DOMPurify 2.0.17. Related...

CVE-2019-16728

Summary: CVE-2019-16728 affects DOMPurify prior to 2.0.1, enabling cross-site scripting via innerHTML mutation XSS (mXSS) in SVG or MATH elements, demonstrated in Chrome and Safari. Affected component: DOMPurify (HTML, MathML, SVG sanitization code). Root cause: improper handling of innerHTML mut...

CVE-2026-41240

Summary of technical details (CVE-2026-41240) : DOMPurify prior to 3.4.0 has an inconsistency between FORBID_TAGS and FORBID_ATTR when function-based ADD_TAGS is used. The fix added an early exit for FORBID_ATTR but the FORBID_TAGS path remained unpatched, causing short-circuiting that allows for...

CVE-2019-25155

DOMPurify before 1.0.11 is affected by a reverse tabnabbing issue in demos/hooks-target-blank-demo.html due to missing rel="noopener noreferrer" on links. This is the concrete vulnerability described across CVE-2019-25155 entries: the root cause is the absence of a security attribute on target-bl...