An open index of dependabot pull requests across open source projects.

dompurify

Ecosystem:
npm
Package URL:
pkg:npm/dompurify
Total PRs:
5,433 Dependabot PRs
Latest PR:
about 2 hours ago
Unique Repositories:
3,299 repositories
Unique Repos (30 days):
269 repositories
Security Advisories
DOMPurify is vulnerable to mutation-XSS via Re-Contextualization
GHSA-h8r8-wccr-v5f2 MODERATE published 3 months ago • updated about 11 hours ago
## Description A mutation-XSS (mXSS) condition was confirmed when sanitized HTML is reinserted into a new parsing context using `innerHTML` and sp...
DOMPurify USE_PROFILES prototype pollution allows event handlers
GHSA-cj63-jhhr-wcxv MODERATE published 2 months ago • updated about 11 hours ago
## Summary When `USE_PROFILES` is enabled, DOMPurify rebuilds `ALLOWED_ATTR` as a plain array before populating it with the requested allowlists. B...
Cross-site Scripting in dompurify
GHSA-63q7-h895-m982 CVE-2020-26870 MODERATE published over 5 years ago • updated about 12 hours ago
Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tr...
DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback
GHSA-v9jr-rg53-9pgp CVE-2026-41238 MODERATE published about 2 months ago • updated about 11 hours ago
## Summary DOMPurify versions 3.0.1 through 3.3.3 (latest) are vulnerable to a prototype pollution-based XSS bypass. When an application uses `DOM...
DOMPurify allows Cross-site Scripting (XSS)
GHSA-vhxf-7vqr-mrjg CVE-2025-26791 MODERATE published over 1 year ago • updated 2 days ago
DOMPurify before 3.2.4 has an incorrect template literal regular expression when SAFE_FOR_TEMPLATES is set to true, sometimes leading to mutation c...
Recent PRs
Package Details
Name: dompurify
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/dompurify
JSON API: View JSON
Security Advisories

18

Active advisories
CRITICAL 2
HIGH 3
MODERATE 13
View All npm Advisories
Package Information
Description:

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin

Repository: https://github.com/cure53/DOMPurify
Homepage: https://github.com/cure53/DOMPurify
Latest Release: 3.2.6
about 1 year ago
Dependent Repos: 56,633
Dependent Packages: 1,705
Downloads: 43,072,032
Ranking: Top 0.1284% by dependent repos Top 0.0589% by downloads Top 0.0449% by dependent pkgs
PR Status
Open 2,791 (51.4%)
Merged 269 (5.0%)
Closed 2,127 (39.1%)
PR Types
Major 499 (9.2%)
Minor 2,369 (43.6%)
Patch 2,279 (41.9%)
Removal 1 (0.0%)