Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-6688-9rhm-gjv2
  • npm/dompurify
 DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries... 05 Oct
  • Fix available
GHSA-p98j-92pf-mc4p
  • npm/dompurify
 DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree... 30 Sep
  • Fix available
  • Severity - 2.3 (Low)
GHSA-55q2-fjhq-7xh7
  • npm/dompurify
 DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS 07 Aug
  • Fix available
  • Severity - 5.1 (Medium)
GHSA-c2j3-45gr-mqc4
  • npm/dompurify
 DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements. 21 Jul
  • Fix available
  • Severity - 2.1 (Low)
GHSA-cmwh-pvxp-8882
  • npm/dompurify
 DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch) 18 Jun
  • Fix available
  • Severity - 5.1 (Medium)
GHSA-vxr8-fq34-vvx9
  • npm/dompurify
 DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output 15 Jun
  • Fix available
  • Severity - 2.1 (Low)
GHSA-gvmj-g25r-r7wr
  • npm/dompurify
 DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes 15 Jun
  • Fix available
  • Severity - 2.0 (Low)
GHSA-rp9w-3fw7-7cwq
  • npm/dompurify
 DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content 15 Jun
  • Fix available
  • Severity - 5.1 (Medium)
GHSA-x4vx-rjvf-j5p4
  • npm/dompurify
 DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects 15 Jun
  • No fix available
GHSA-76mc-f452-cxcm
  • npm/dompurify
 DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR` 15 Jun
  • Fix available
  • Severity - 6.1 (Medium)
GHSA-hpcv-96wg-7vj8
  • npm/dompurify
 DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks 15 Jun
  • Fix available
  • Severity - 6.1 (Medium)
GHSA-r47g-fvhr-h676
  • npm/dompurify
 DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM 15 Jun
  • Fix available
  • Severity - 6.1 (Medium)
GHSA-87xg-pxx2-7hvx
  • npm/dompurify
 DOMPurify XSS via selectedcontent re-clone 01 Jun
  • Fix available
  • Severity - 8.2 (High)
GHSA-h7mw-gpvr-xq4m
  • npm/dompurify
 DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) 22 Apr
  • Fix available
  • Severity - 6.0 (Medium)
GHSA-crv5-9vww-q3g8
  • npm/dompurify
 DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode 22 Apr
  • Fix available
  • Severity - 6.8 (Medium)
GHSA-v9jr-rg53-9pgp
  • npm/dompurify
 DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback 22 Apr
  • Fix available
  • Severity - 6.9 (Medium)
Load more...