Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
dompurify: Malicious code can run in user's browser
published 6 years ago
Summary
An older version of the dompurify library allows attackers to inject malicious code into a website, potentially letting them control the user's browser. This could lead to unauthorized actions or data theft. To fix this, update to version 2.0.7 or later.
What to do
- Update cure53 dompurify to version 2.0.7.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | cure53 | dompurify |
< 2.0.7 Fix: upgrade to 2.0.7
|
Original advisory text
Cross-Site Scripting in dompurify
Versions of `dompurify` prior to 2.0.7 are vulnerable to Cross-Site Scripting (XSS). It is possible to bypass the package sanitization through Mutation XSS, which may allow an attacker to execute arbitrary JavaScript in a victim's browser.
## Recommendation
Upgrade to version 2.0.7 or later.
## Recommendation
Upgrade to version 2.0.7 or later.
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published3 Sep 2020
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-mjjq-c88q-qhr6 · GHSA
Track software like this
Free during beta