GHSA-v8jm-5vwx-cfxm

Source

https://github.com/advisories/GHSA-v8jm-5vwx-cfxm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-v8jm-5vwx-cfxm/GHSA-v8jm-5vwx-cfxm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-v8jm-5vwx-cfxm

Aliases

CVE-2025-15599

Downstream

CGA (34)

MINI (3)

Published

2026-03-03T18:31:33Z

Modified

2026-09-10T03:50:41Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

DOMPurify contains a Cross-site Scripting vulnerability

Details

DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-04T20:50:09Z",
    "nvd_published_at":  "2026-03-03T18:16:23Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / dompurify

Package

Name: dompurify; View open source insights on deps.dev
Purl: pkg:npm/dompurify

Affected ranges

Type: SEMVER
Events: Introduced

3.1.3

Fixed

3.2.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-v8jm-5vwx-cfxm/GHSA-v8jm-5vwx-cfxm.json"

npm / dompurify

Package

Name: dompurify; View open source insights on deps.dev
Purl: pkg:npm/dompurify

Affected ranges

Type: SEMVER
Events: Introduced

2.5.3

Last Affected

2.5.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-v8jm-5vwx-cfxm/GHSA-v8jm-5vwx-cfxm.json"