Product by Cure53

    DOMPurify

    35 known vulnerabilities in DOMPurify (Cure53), 0 of them actively exploited (CISA KEV).

    Key figures

    35

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    2

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in DOMPurify (Cure53)
    MediumCVE-2020-26870

    DOMPurify: Cross-Site Scripting (XSS)

    also in 4 other products

    		6.1
    CriticalCVE-2024-47875

    DOMPurify nesting-based mXSS

    also in 10 other products

    		10.0
    CriticalCVE-2024-48910

    DOMPurify vulnerable to tampering by prototype polution

    also in 1 other product

    		9.1
    HighCVE-2026-47423

    DOMPurify XSS via `selectedcontent` re-clone

    also in 1 other product

    		8.2
    MediumCVE-2019-16728

    DOMPurify: Cross-Site Scripting (XSS)

    also in 1 other product

    		6.1
    HighCVE-2024-45801

    Tampering by prototype polution in DOMPurify

    also in 9 other products

    		7.3
    MediumCVE-2026-109345

    DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root

    		6.1
    MediumCVE-2026-65899

    DOMPurify before 3.4.9 Trusted Types Policy State Contamination

    		6.1
    MediumCVE-2026-49978

    DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

    also in 2 other products

    		6.1
    MediumCVE-2026-116802

    DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode

    		6.1
    HighCVE-2025-48050

    Cure53 DOMPurify: Path Traversal: '../filedir'

    		7.5
    MediumCVE-2026-109344

    DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks

    		6.1
    MediumCVE-2026-116804

    DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content

    		6.1
    MediumCVE-2026-49458

    Cure53 DOMPurify: Cross-site Scripting

    		6.1
    MediumCVE-2026-116803

    DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees

    		6.1
    MediumCVE-2026-41240

    Cure53 DOMPurify: Cross-site Scripting

    also in 3 other products

    		6.1
    MediumCVE-2026-65902

    DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags

    		6.1
    MediumCVE-2026-49459

    Cure53 DOMPurify: Prototype Pollution

    		6.1
    HighCVE-2026-65898

    DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig

    		7.2
    MediumCVE-2026-75838

    DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

    		—
    MediumCVE-2026-65911

    DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage

    		6.1
    MediumCVE-2026-65903

    DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS

    		6.1
    MediumCVE-2026-65913

    DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES

    		6.1
    MediumCVE-2026-65900

    DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM

    		6.1
    MediumCVE-2026-65914

    DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization

    also in 1 other product

    		6.1

    All vulnerabilities in search

    All products by Cure53